Concrete CMS Stored Cross-Site Scripting Vulnerability in Legacy Form Element

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions prior to 9.4.8. This issue allows users with permission to edit pages containing the 'Legacy Form' element to inject malicious scripts into the 'Question' field. These scripts are then executed when high-privilege accounts view the page. The vulnerability arises from improper handling of user input in the form element, enabling the injection of JavaScript that can be executed by other users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Remediation

Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.