CyberRota Analysis
AI-GeneratedConcrete CMS Community Store versions prior to 2.7.8 are vulnerable due to the use of predictable download tokens derived from order creation timestamps. This flaw allows unauthenticated attackers to enumerate order and file identifiers, potentially enabling them to access and download digital products purchased by other customers. Organizations using this CMS should prioritize patching to mitigate the risk of unauthorized access to sensitive digital goods.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.