CyberRota Analysis
AI-GeneratedConcrete CMS Community Store versions prior to 2.7.8 are vulnerable due to improper handling of customer-supplied order fields, allowing unauthenticated attackers to inject script payloads. This can lead to the execution of malicious scripts in authenticated manager sessions, potentially enabling account creation or data exfiltration. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.