Concrete CMS Stored Cross-Site Scripting Vulnerability in Switch Language Block

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions prior to 9.4.8. This issue allows a rogue administrator to inject malicious scripts through the Switch Language block, which are then executed when the language is switched. The vulnerability arises because the block does not properly sanitize input before displaying it, enabling the injection of JavaScript that can be executed by users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Remediation

Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.