Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

Concrete CMS 9 before version 9.5.0 has a weakness that allows attackers to trick users into performing unwanted actions on the site, such as reordering items, without the user's knowledge. This happens because the system doesn't properly verify that requests are legitimate.

A Cross Site Request Forgery (CSRF) vulnerability exists in the express association reorder endpoint (concrete/controllers/dialog/express/association/reorder) due to insufficient request validation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated administrator, performs unauthorized reordering of express associations through their browser session. The attack requires user interaction (visiting a malicious site) and has low integrity impact.