CVE-2023-37269

Winter CMS up to version 1.2.12 contains a vulnerability that allows authenticated backend users to disclose arbitrary files readable by the PHP process by injecting @import directives into LESS source. The flaw is due to the LESS parser being instantiated without a safe import resolver. Fixed in version 1.2.13.

Winter CMS up to version 1.2.12 contains a vulnerability in the backend FileUpload form widget that trusts an attacker-controlled file_id POST parameter when resolving the attachment, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. Fixed in version 1.2.13.

Winter CMS up to and including 1.2.12 did not enforce per-template-type permission checks in the Theme Editor, allowing a backend user with any single CMS permission to act on template types outside their scope. Additionally, the AssetList widget allowed unauthorized file uploads into the active theme's asset directory.

Winter CMS up to and including 1.2.12 is vulnerable to SQL injection in the backend Filter widget via the numberrange scope type when configured with a conditions key, allowing an authenticated backend user to inject arbitrary SQL. Exploitation requires a third-party plugin to have registered such a filter.

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

Winter CMS before version 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.