CVE-2023-49337 (published 2024-02-29T01:41Z)

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/concretecms/concretecms
commit_details: repo_url: https://github.com/concretecms/concretecms
author: Andrew Embler
author_date: 2023-11-09 15:29:12-08:00
msg: Sanitize site name everywhere
repository: repo_url: https://github.com/concretecms/concretecms
repo_name: concretecms/concretecms
description: Official repository for Concrete CMS development
repo_language: PHP
owner: concretecms
file_changes: filename: controller.php
change_type: ModificationType.MODIFY
diff: @@ -56,7 +56,7 @@ public function form()
         }
         $sites = array('' => t('** Select Site'));
         foreach($this->app->make('site')->getList() as $site) {
-            $sites[$site->getSiteID()] = $site->getSiteName();
+            $sites[$site->getSiteID()] = h($site->getSiteName());
         }
         $form = $this->app->make('helper/form');
         print $form->select($this->field('siteID'), $sites, $siteID);
@@ -66,7 +66,7 @@ public function getDisplayValue()
     {
         $site = $this->getValue();
         if (is_object($site)) {
-            return $site->getSiteName();
+            return h($site->getSiteName());
         }
     }
 

programming_language: PHP
filename: controller.php
change_type: ModificationType.MODIFY
diff: @@ -295,7 +295,7 @@ private function passwordUpgrade(?UserInfo $userInfo, ErrorList $error, bool $is
                 }
                 $mh->from($fromEmail, $fromName);
             }
-            $mh->addParameter('siteName', tc('SiteName', $this->app->make('site')->getSite()->getSiteName()));
+            $mh->addParameter('siteName', h(tc('SiteName', $this->app->make('site')->getSite()->getSiteName())));
             $mh->load('forgot_password');
             $mh->setIsThrowOnFailure(true);
             try {

programming_language: PHP
filename: controller.php
change_type: ModificationType.MODIFY
diff: @@ -126,7 +126,7 @@ public function getRequiredFeatures(): array
     public function add()
     {
         $site = $this->app->make('site')->getSite();
-        $brandingText = $site->getSiteName();
+        $brandingText = h($site->getSiteName());
         /** @var Detector $detector */
         $detector = $this->app->make('multilingual/detector');
 
@@ -250,7 +250,7 @@ public function view()
         }
         if ($this->includeBrandText && !$this->brandingText) {
             $site = $this->app->make('site')->getSite();
-            $brandingText = $site->getSiteName();
+            $brandingText = h($site->getSiteName());
             $this->set('brandingText', $brandingText);
         }
         if ($this->brandingTransparentLogo) {

programming_language: PHP
filename: sites.php
change_type: ModificationType.MODIFY
diff: @@ -218,7 +218,7 @@ protected function setCurrentSite(?Site $site): void
             $menu = null;
         } else {
             $breadcrumb = $this->app->make(DashboardBreadcrumbFactory::class)->getBreadcrumb($this->getPageObject());
-            $breadcrumb->add(new Item('', $site->getSiteName()));
+            $breadcrumb->add(new Item('', h($site->getSiteName())));
             $this->setBreadcrumb($breadcrumb);
             $menu = new Element('dashboard/system/multisite/site/menu', '', $this->getPageObject(), ['site' => $site]);
         }

programming_language: PHP
filename: bulk.php
change_type: ModificationType.MODIFY
diff: @@ -116,7 +116,7 @@ protected function getSiteNameForPage(Page $page): string
             }
             $siteName = $this->getSiteNameForLocale($locale);
         } else {
-            $siteName = $this->app->make('site')->getSite()->getSiteName();
+            $siteName = h($this->app->make('site')->getSite()->getSiteName());
         }
 
         return $siteName;

programming_language: PHP
filename: register.php
change_type: ModificationType.MODIFY
diff: @@ -169,7 +169,7 @@ public function do_register()
                                 'display');
                     }
                     $mh->addParameter('attribs', $attribValues);
-                    $mh->addParameter('siteName', tc('SiteName', \Core::make('site')->getSite()->getSiteName()));
+                    $mh->addParameter('siteName', h(tc('SiteName', \Core::make('site')->getSite()->getSiteName())));
 
                     if ($config->get('concrete.email.register_notification.address')) {
                         if ($config->get('concrete.email.register_notification.name')) {

programming_language: PHP
filename: header_required.php
change_type: ModificationType.MODIFY
diff: @@ -61,7 +61,7 @@
                 }
                 $seo->addTitleSegmentBefore($pageTitle);
             }
-            $seo->setSiteName(tc('SiteName', $site->getSiteName()));
+            $seo->setSiteName(h(tc('SiteName', $site->getSiteName())));
             $seo->setTitleFormat($appConfig->get('concrete.seo.title_format'));
             $seo->setTitleSegmentSeparator($appConfig->get('concrete.seo.title_segment_separator'));
             $pageTitle = $seo->getTitle();

programming_language: PHP
filename: view_details.php
change_type: ModificationType.MODIFY
diff: @@ -116,7 +116,7 @@
                 <?php foreach ($sites as $site) { ?>
                     <tr>
                         <td>
-                            <?php echo $site->getSiteName() ?>
+                            <?php echo h($site->getSiteName()); ?>
                         </td>
 
                         <td style="white-space: nowrap" class="text-center">

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@
 $site = app('site')->getSite() ?? null;
 $siteName = '';
 if ($site) {
-    $siteName = $site->getSiteName();
+    $siteName = h($site->getSiteName());
 }
 
 ?>

programming_language: PHP
filename: SiteGroup.php
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@ public function __construct(Site $site)
 
     public function getEntryGroupLabel()
     {
-        return $this->site->getSiteName();
+        return h($this->site->getSiteName());
     }
 
     public function getEntryGroupIdentifier()

programming_language: PHP
filename: SiteEntry.php
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@ public function __construct(Site $site)
 
     public function getLabel()
     {
-        return $this->site->getSiteName();
+        return h($this->site->getSiteName());
     }
 
     public function getSiteTreeID()

programming_language: PHP
filename: SiteValue.php
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@ public function getValue()
     public function __toString()
     {
         if (is_object($this->site)) {
-            return (string) $this->site->getSiteName();
+            return (string) h($this->site->getSiteName());
         }
         return '';
     }

programming_language: PHP
filename: SiteTree.php
change_type: ModificationType.MODIFY
diff: @@ -49,7 +49,7 @@ public function getSiteType()
 
     public function getDisplayName()
     {
-        return $this->getLocale()->getSite()->getSiteName();
+        return h($this->getLocale()->getSite()->getSiteName());
     }
 
 }

programming_language: PHP
filename: SiteSelector.php
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@ public function selectSite($fieldName, $siteID = false, $includeCurrent = false,
         foreach(\Core::make('site')->getList() as $site) {
             $sp = new \Permissions($site);
             if ($sp->canViewSiteInSelector()) {
-                $sites .= '<option ' . ($site->getSiteID() == $siteID ? 'selected' : '') . ' value="' . $site->getSiteID() . '">' . $site->getSiteName() . '</option>';
+                $sites .= '<option ' . ($site->getSiteID() == $siteID ? 'selected' : '') . ' value="' . $site->getSiteID() . '">' . h($site->getSiteName()) . '</option>';
             }
         }
 

programming_language: PHP
filename: InstallerOptions.php
change_type: ModificationType.MODIFY
diff: @@ -251,7 +251,7 @@ public function setStartingPointHandle($value)
      */
     public function getSiteName()
     {
-        return $this->siteName;
+        return h($this->siteName);
     }
 
     /**

programming_language: PHP