CVE-2024-1245: 
PHP vulnerability analysis and mitigation

CVE-2024-1245 affects Concrete CMS version 9 before 9.2.5, discovered and disclosed in February 2024. The vulnerability is a stored Cross-Site Scripting (XSS) issue in the file tags and description attributes functionality of the content management system (Concrete Advisory, NVD).

The vulnerability stems from insufficient sanitization of administrator-entered file attributes in the Edit Attributes page. It is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS v3.1 scores: NIST rates it as 4.8 (Medium) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while ConcreteCMS rates it as 2.4 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows a rogue administrator to inject malicious code into file tags or description attributes. When another administrator opens the same file for editing, the malicious code could execute in their browser context (Concrete Advisory).

The vulnerability has been fixed in Concrete CMS version 9.2.5. Users should upgrade to this version or later to address the security issue. The fix was implemented in commit 11927 (Release Notes).