Concrete CMS vulnerabilities

Vulnerability in Concrete CMS below version 9.5.2 allows an unauthenticated attacker to perform PHP object injection via unserialize() calls in Permission, Cache, and Search components. The attack requires a malicious payload to be placed in the database.

Concrete CMS below version 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database.

Concrete CMS versions 9.0 to 9.5.0 are vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages.

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering.

Concrete CMS version 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. A victim with edit_file_contents permission can be tricked into publishing an attacker-chosen previously-uploaded file version (downgrade or activation of an unpublished version).

Concrete CMS 9 before version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the approveVersion() controller. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an administrator.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). An attacker can trick an administrator into performing unwanted file operations.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). An attacker can trick an administrator into rescanning a file.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). An attacker can trick an administrator into starring a file.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the removeFavoriteFolder($id) endpoint. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the addFavoriteFolder($id) endpoint. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the reorder endpoint of the Express Association dialog. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the duplicate endpoint of the Event dialog. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the design endpoint of the Page Bulk dialog. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the cache endpoint of the Page Bulk dialog. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the delete endpoint of the Page Bulk dialog. An attacker can exploit this to perform unauthorized actions on behalf of the victim.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. CVSS v4.0: 2.3.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. CVSS v4.0: 2.3.

IDOR vulnerability in Concrete CMS 9.5.0 and below allows unauthenticated attackers to vote in restricted surveys via a public endpoint.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking.

Concrete CMS version 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. The pagination function directly interpolates the $URL field into the href attribute, allowing an authenticated admin or report viewer to execute JavaScript by clicking a crafted link.

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_detail' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint '/ccm/system/dialogs/file/usage/{fID}' accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses sanitization. A rogue editor can inject arbitrary JavaScript.

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation, enabling redirect-to-internal bypasses.

In Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler bypasses account status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.

Concrete CMS version 9.5.0 and below is vulnerable to IDOR in the AddMessage and UpdateMessage controllers via the attachments[] parameter. They lack per-file permission checks (canViewFile()), allowing a user who can post in any conversation to reference any file in the CMS file manager by its ID, bypassing the permission system.

Concrete CMS version 9.5.0 and below is vulnerable to unauthorized file deletion due to an inverted CSRF token check in the DeleteFile controller. The CSRF token is rejected when valid and accepted when invalid, enabling CSRF attacks against users with permission to edit conversation messages.

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions.

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.

Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view, but the do_update() method does not validate it. An attacker can exploit this to perform a CSRF attack that updates the CMS to an attacker-specified version.

Concrete CMS 9.5.0 and below does not validate CSRF tokens for requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker controlling a remote package can overwrite PHP files and force execution of the upgrade() method, leading to remote code execution.

Concrete CMS 9.5.0 and below has a CSRF vulnerability in the install_package() method. An attacker can trick an admin into installing a malicious package, leading to remote code execution.

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. An attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.

In Concrete CMS 9.5.0 and below, missing authorization in bulk_user_assignment.php allows any authenticated user to add any email to any group and remove legitimate admins, leading to privilege escalation.

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block. The action_get_events function does not check canView on the calendar, resulting in restricted event details being disclosed.

Concrete CMS version 9.5.0 and below is vulnerable to authorization bypass in the Calendar Event Frontend Dialog, allowing cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.

Concrete CMS version 9.5.0 and below contains a stored XSS vulnerability in the height parameter. The controller does not validate or sanitize the $height value, allowing users with editor privileges to inject malicious JavaScript executed in visitors' browsers.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.

Concrete CMS version 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method only checks the canInstallPackages() permission before fetching a remote package and writing it to the DIR_PACKAGES directory. An attacker can force an authenticated administrator to download an arbitrary marketplace package.

Concrete CMS version 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller. A rogue administrator with privileges to add blocks can bypass the protection mechanism (_fromCIF === true) by leveraging the REST API, which parses requests using json_decode(), where the string "true" is evaluated as a strict PHP Boolean(true). This allows injection of a malicious serialized payload into the block's filterFields column, which is executed when the block data is viewed or edited, leading to full server takeover.

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can include arbitrary readable files on the server. Combined with extension-only validation (allowing PHP code in .png files), this can lead to authenticated remote code execution.

Concrete CMS version 9.5.0 and below is vulnerable to unauthenticated file usage disclosure due to missing permission checks in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of pages referencing that file, including page IDs, handles, and full URLs, even for restricted pages.