Concrete CMS Stored Cross-Site Scripting Vulnerability in Legacy Form Block

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions prior to 9.4.8, specifically within the 'Legacy Form' block. This vulnerability allows an authenticated user with the ability to create or edit forms, such as a rogue administrator, to inject a persistent JavaScript payload into the options of multiple-choice questions, including Checkbox Lists, Radio Buttons, or Select Boxes. The injected script is executed in the browser of any user who views the page containing the form.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.