CVE-2023-44760

MEDIUM

Concrete CMS 9.2.1 - Stored Cross-Site Scripting in SEO & Statistics Tracking Codes

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-44760. PoCs published by sromanhu.

AI-analyzed exploit summary This repository demonstrates a stored XSS vulnerability in ConcreteCMS v9.2.1 via the Header and Footer Tracking Codes in the SEO & Statistics section. The PoC includes a functional payload that executes arbitrary JavaScript when injected into these fields.

Description

Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.

Exploits (1)

nomisec WORKING POC
by sromanhu · poc
https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes

This repository demonstrates a stored XSS vulnerability in ConcreteCMS v9.2.1 via the Header and Footer Tracking Codes in the SEO & Statistics section. The PoC includes a functional payload that executes arbitrary JavaScript when injected into these fields.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: ConcreteCMS v9.2.1
Auth required
Prerequisites: Access to the ConcreteCMS admin panel · Permission to modify SEO & Statistics settings
MITRE ATT&CK
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 4.8
EPSS 0.0023
EPSS Percentile 46.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
concrete5/concrete5 0Packagist
concretecms/concrete_cms 9.2.1
Published Oct 23, 2023
Tracked Since Feb 18, 2026