Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend user to inject arbitrary SQL. The scope's filter values are interpolated into the conditions statement without parameter binding, so a user with access to a list view whose filter uses this scope and configuration can supply crafted input through the filter's AJAX handler and read arbitrary database contents. No built-in Winter CMS backend views use this scope type and configuration combination, so exploitation requires a third-party plugin to have registered a numberrange filter scope with a conditions key, and a vanilla installation without such plugins is not affected. This issue is fixed in version 1.2.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-26T18:16:29.890Z",
  "pubdate": "2026-08-26T18:16:29.890Z",
  "executiveSummary": "Winter CMS versions up to and including 1.2.12 contain a SQL injection vulnerability within the backend Filter widget, specifically affecting the 'numberrange' scope type.\nThe vulnerability occurs when a 'numberrange' scope is configured with a 'conditions' key, leading to improper input sanitization of filter values.\nSuccessful exploitation allows an authenticated backend user with access to a relevant list view to perform arbitrary SQL injection, enabling unauthorized retrieval of sensitive database contents.\nThis flaw requires the presence of a third-party plugin that registers a 'numberrange' filter scope with a 'conditions' key, as no core Winter CMS backend views utilize this vulnerable configuration by default.\nThe risk is limited to authenticated environments, as the attack vector requires backend access and specific plugin-driven filter configurations.\nWinter CMS has remediated this issue in version 1.2.13 by implementing proper parameter binding, and upgrading is the primary defense.",
  "technicalDetails": "The vulnerability resides in the backend Filter widget component of Winter CMS, specifically within the logic handling the 'numberrange' scope type.\nThe root cause is the unsafe interpolation of user-supplied filter values directly into the SQL 'conditions' statement associated with the 'numberrange' scope.\nBecause the filter values are concatenated into the query string without utilizing prepared statements or parameter binding, the backend engine is susceptible to injection of arbitrary SQL fragments.\nThe attack flow begins when an authenticated backend user identifies a list view that employs a third-party plugin using the vulnerable 'numberrange' scope configuration.\nThe attacker interacts with the Filter widget's AJAX handler, submitting a crafted payload designed to break out of the intended query syntax. Since the application fails to sanitize the input or bind it as a parameter, the malicious SQL is executed within the context of the database query process.\nBy manipulating the conditions statement, an attacker can perform unauthorized data extraction, potentially exposing the entire database or performing other malicious operations depending on the database user permissions.\nVulnerable versions include all releases up to and including 1.2.12. The issue is strictly tied to configurations where the 'conditions' key is explicitly defined for the 'numberrange' scope, meaning vanilla installations of Winter CMS are not natively affected unless third-party code introduces the vulnerable pattern.\nAuthentication and backend access are prerequisites for exploitation, making this a post-authentication vulnerability. There is no remote network exposure for unauthenticated users, as the endpoint is protected by the Winter CMS backend authentication layer.\nThe primary impact is unauthorized read access to the application database, which may contain sensitive administrative data, user information, or configuration details.\nResolution was achieved in version 1.2.13, where the framework was updated to ensure that values provided to the 'numberrange' scope are properly handled via parameter binding rather than string interpolation."
}