Stored XSS in Concrete CMS Community Store

Concrete CMS Community Store versions before 2.7.8 are susceptible to a stored cross-site scripting (XSS) vulnerability due to improper input sanitization. The vulnerability exists because customer-supplied fields, specifically billing name, email, and phone, are rendered in the store's checkout and administrative interfaces without adequate HTML escaping. An unauthenticated attacker can exploit this flaw by submitting malicious JavaScript payloads through these fields during the order process. When an administrator or manager subsequently views the order details within the Concrete CMS dashboard, the malicious script executes within the context of the manager's authenticated session. This allows the attacker to perform unauthorized actions, including the creation of rogue administrative accounts or the exfiltration of sensitive order and customer data.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to hijack administrative sessions, leading to full site compromise, unauthorized administrative actions, and potential data exfiltration. Given that the Community Store is a core component for e-commerce functionality, the impact covers all Concrete CMS instances utilizing this plugin, potentially affecting the integrity and confidentiality of store transaction data and administrative controls.

Recommendation

• Upgrade the Concrete CMS Community Store plugin to version 2.7.8 or later immediately.
• Implement a web application firewall (WAF) rule to block common XSS payloads in parameters associated with billing or checkout forms.
• Audit existing order records in the administrative console for suspicious script injection patterns in billing name, email, or phone fields.