Executive brief
The Document Library block in Concrete CMS, a popular open-source content management system, fails to properly validate file-set identifiers submitted by administrators. An authenticated user with permission to add or edit Document Library blocks can inject malicious SQL code into the block configuration that persists in the database and executes every time the published page is rendered, potentially exposing sensitive data from the CMS database.
Technical details
This is a stored SQL injection vulnerability in the Document Library block that results from improper input validation and parameterization. The vulnerability exists in the btDocumentLibrary.setIds configuration: file-set identifiers (fsID[]) are stored without validation as integers, and when setMode is configured to "any," these identifiers are concatenated directly into the file-set filter SQL query without casting or parameter binding. An authenticated administrator can persist SQL syntax in the block configuration; this stored expression is executed every time a page containing the block is rendered, allowing time-based blind SQL injection attacks. The vulnerability was patched in version 9.5.3 and requires authentication and user interaction (page editing permission) to exploit.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Patched in version 9.5.3