CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to a SQL injection issue due to improper handling of wildcard characters in keyword search filters, which can be exploited by authenticated users with editor-level privileges. This flaw allows crafted search queries to trigger full-table scans, potentially leading to significant performance degradation and increased database load. Organizations using Concrete CMS, particularly those with large installations and multiple editors, should prioritize addressing this vulnerability to maintain system responsiveness and user experience.
Original NVD Description
Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards. Because the keyword input was placed into the LIKE clause without neutralizing its wildcard metacharacters, a short request could force the database to evaluate every row and perform a full-table scan, and repeated or wildcard-dense searches could sustain elevated database CPU and I/O, degrading responsiveness for other users on large installations. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Thanks noivan for reporting.