CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.5.2 and below are susceptible to Cross-Site Request Forgery (CSRF) in the "Clear Entries" function, allowing remote unauthenticated attackers to exploit the vulnerability by tricking authenticated administrators into visiting malicious pages. This can lead to the permanent deletion of all entries associated with a targeted Express entity, as the system fails to enforce CSRF token validation. Organizations using affected versions of Concrete CMS should prioritize patching to mitigate the risk of unauthorized data loss.
Original NVD Description
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation to proceed when the token is missing or invalid. A remote unauthenticated attacker can force an authenticated administrator who visits an attacker-controlled page to permanently delete all entries belonging to an attacker-selected Express entity on a web application to which the administrator is currently authenticated. Because the default Contact Express object ships with a fixed entity UUID, the target identifier can be obtained without dashboard access. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Pratik Zanjurne for reporting.