Concrete CMS vulnerabilities

Concrete CMS 9.5.0 and below does not validate CSRF tokens for requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker controlling a remote package can overwrite PHP files and force execution of the upgrade() method, leading to remote code execution.

Concrete CMS 9.5.0 and below has a CSRF vulnerability in the install_package() method. An attacker can trick an admin into installing a malicious package, leading to remote code execution.

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. An attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.

In Concrete CMS 9.5.0 and below, missing authorization in bulk_user_assignment.php allows any authenticated user to add any email to any group and remove legitimate admins, leading to privilege escalation.

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block. The action_get_events function does not check canView on the calendar, resulting in restricted event details being disclosed.

Concrete CMS version 9.5.0 and below is vulnerable to authorization bypass in the Calendar Event Frontend Dialog, allowing cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.

Concrete CMS version 9.5.0 and below contains a stored XSS vulnerability in the height parameter. The controller does not validate or sanitize the $height value, allowing users with editor privileges to inject malicious JavaScript executed in visitors' browsers.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The <strong>...</strong> wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.

Concrete CMS version 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method only checks the canInstallPackages() permission before fetching a remote package and writing it to the DIR_PACKAGES directory. An attacker can force an authenticated administrator to download an arbitrary marketplace package.

Concrete CMS version 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller. A rogue administrator with privileges to add blocks can bypass the protection mechanism (_fromCIF === true) by leveraging the REST API, which parses requests using json_decode(), where the string "true" is evaluated as a strict PHP Boolean(true). This allows injection of a malicious serialized payload into the block's filterFields column, which is executed when the block data is viewed or edited, leading to full server takeover.

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can include arbitrary readable files on the server. Combined with extension-only validation (allowing PHP code in .png files), this can lead to authenticated remote code execution.

Concrete CMS version 9.5.0 and below is vulnerable to unauthenticated file usage disclosure due to missing permission checks in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of pages referencing that file, including page IDs, handles, and full URLs, even for restricted pages.