Executive brief
Concrete CMS Community Store is an e-commerce plugin that allows vendors to sell digital products. The vulnerability allows attackers without authentication to download any customer's purchased digital goods by predicting download tokens based on order timestamps. An attacker can enumerate orders and calculate valid download tokens, resulting in unauthorized access to sold digital content.
Technical details
The vulnerability exists in the Download.php utility class, which generates digital product download tokens using MD5(order_creation_timestamp) instead of cryptographically random values. Unauthenticated attackers can enumerate sequential order IDs and file IDs, then brute-force or calculate valid download tokens. The attack requires only network access and knowledge that an order exists, with no authentication or user interaction needed.
Affected products
- Concrete CMS Community Store before 2.7.8
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in version 2.7.8