CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable due to improper validation of file-set identifiers in the Document Library block, allowing authenticated users to inject SQL syntax into the configuration. This results in stored, time-based blind SQL injection, which could lead to unauthorized data access or manipulation. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of casting it or binding it as a parameter. An authenticated user permitted to add or edit a Document Library block could therefore persist SQL syntax in the block configuration (btDocumentLibrary.setIds), and that stored expression was executed every time the published page containing the block was rendered, producing stored, time-based blind SQL injection. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Habib Allah for reporting.