CVE-2023-48653: 
PHP vulnerability analysis and mitigation

Concrete CMS before 8.5.14 and 9 before 9.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability via ccm/calendar/dialogs/event/delete/submit. This vulnerability was discovered and fixed in December 2023, affecting multiple versions of the CMS platform (NVD, Vendor Advisory).

The vulnerability exists in the calendar event deletion functionality where the event ID is numeric and sequential, making it predictable. The CVSS v3.1 base score is 4.3 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue was addressed by updating Dialog endpoints to only accept Post requests with tokens included (Release Notes).

An attacker can exploit this vulnerability to force an authenticated administrator to delete events on the site. The sequential nature of the event IDs makes it easier for attackers to target specific calendar events (Vendor Advisory).

The vulnerability requires user interaction (UI:R) but no privileges (PR:N) to exploit. The attack can be launched from the network (AV:N) with low attack complexity (AC:L). The sequential nature of event IDs makes it particularly exploitable as attackers can predict valid targets (NVD).

The vulnerability has been fixed in Concrete CMS versions 8.5.14 and 9.2.3. Users are strongly advised to upgrade to these or later versions. The fix implements proper CSRF protection by ensuring Dialog endpoints only accept Post requests with valid tokens (Release Notes).

The vulnerability was reported by Veshraj Ghimire and was assessed by the Concrete CMS Security team with a CVSS v3 score of 4.3, indicating a moderate severity level (Vendor Advisory).