Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.