Community Store
Monthly
Stored cross-site scripting in the Concrete CMS Community Store package before 2.7.8 lets an unauthenticated shopper plant script payloads in customer-supplied checkout fields - billing first/last name, email, and phone - which the storefront renders without HTML escaping in default order-slip, cart, and checkout templates. The injected script lies dormant until an authenticated store manager or administrator opens the affected order in the order slip or admin order views, at which point it executes in their privileged session and can create rogue accounts or exfiltrate store and customer data. Exploitation requires privileged-user interaction (no public exploit code identified at time of analysis), but because the vulnerable rendering lives in default templates and no non-default configuration is needed, any shop accepting guest orders is exposed - an attacker gains no access unless a manager views the poisoned order, and patch version 2.7.8 is available.
Stored cross-site scripting in the Concrete CMS Community Store package before 2.7.8 lets an unauthenticated shopper plant script payloads in customer-supplied checkout fields - billing first/last name, email, and phone - which the storefront renders without HTML escaping in default order-slip, cart, and checkout templates. The injected script lies dormant until an authenticated store manager or administrator opens the affected order in the order slip or admin order views, at which point it executes in their privileged session and can create rogue accounts or exfiltrate store and customer data. Exploitation requires privileged-user interaction (no public exploit code identified at time of analysis), but because the vulnerable rendering lives in default templates and no non-default configuration is needed, any shop accepting guest orders is exposed - an attacker gains no access unless a manager views the poisoned order, and patch version 2.7.8 is available.