Concrete CMS Stored Cross-Site Scripting Vulnerability in Atomik Theme

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions 9.0 to 9.5.0, specifically within the Atomik theme. This issue allows a rogue editor to inject arbitrary JavaScript into the page name, which then executes in the context of any authenticated user visiting the affected account pages. The consequences of this vulnerability include session hijacking, credential theft, unauthorized actions performed on behalf of users, and potential privilege escalation.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.