Concrete CMS Remote Code Execution Vulnerability via Stored PHP Object Injection

A remote code execution vulnerability has been identified in Concrete CMS versions prior to 9.4.8. This issue arises from stored PHP object injection into the Express Entry List block, specifically through the columns parameter. An authenticated administrator can inject serialized data into block configuration fields, which is later unserialized without any class restrictions or integrity checks. This flaw allows for the execution of arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Concrete CMS is hosted.

Remediation

Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.