https://vulnerability.circl.lu/sightings/feed 2026-08-29T21:19:27.990410+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/78337b51-4d1b-4394-b832-08d8d515c101/export 2026-08-29T21:19:28.004914+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "78337b51-4d1b-4394-b832-08d8d515c101", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-P2CH-C2C3-4XM5", "type": "seen", "source": "https://gist.github.com/alon710/8e50b2fdebb434d200c6fb50163d57dd", "content": "# GHSA-P2CH-C2C3-4XM5: GHSA-P2CH-C2C3-4XM5: Cross-Site Request Forgery in Winter CMS AJAX Routing\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-P2CH-C2C3-4XM5\n\n## Summary\nWinter CMS contains a routing bypass vulnerability that allows Cross-Site Request Forgery (CSRF) attacks to trigger administrative AJAX handlers. Due to case-insensitivity in PHP's method resolution and an insufficiently strict check in the backend controller system, an attacker can invoke these handler methods through lowercase HTTP GET requests, bypassing default CSRF token validation.\n\n## TL;DR\nAn administrative routing bypass in Winter CMS allows attackers to execute highly privileged AJAX handlers via standard HTTP GET requests through cross-site request forgery, leading to unauthorized state-changing operations.\n\n## Technical Details\n\n- **CWE ID**: CWE-352, CWE-178, CWE-862\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1 Score**: 8.8\n- **Exploit Status**: poc\n- **KEV Status**: none\n\n## Affected Systems\n\n- Winter CMS installations running versions prior to v1.2.14\n\n## Mitigation\n\n- Upgrade to Winter CMS version 1.2.14 or above to enforce strict action name casing validations.\n- Implement Web Application Firewall (WAF) rule sets to detect and block access to camelCase backend action paths over HTTP GET.\n\n**Remediation Steps:**\n1. Run 'composer update wintercms/winter' in your project environment.\n2. Verify that the system is running version 1.2.14 or later.\n3. Check access logs for unusual GET requests to '/backend/*/index_on*' or similar patterns.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-P2CH-C2C3-4XM5) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T09:04:13.915474Z"} 2026-08-21T09:04:13.915474+00:00