A weakness, a security issue, and some vulnerabilities have been reported in concrete5, which can be exploited by malicious users to conduct script insertion and SQL injection attacks and by malicious people to bypass certain security restrictions and conduct spoofing and cross-site scripting attacks.

1) Certain input related to a Form block is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

2) The application improperly protects access to index.php/tools/required/files/properties (when "fID" is set to a valid value) and can be exploited to gain knowledge of a file URL and subsequently download an arbitrary and otherwise access restricted uploaded file.

Successful exploitation requires access to the "File Properties" feature (enabled for "Guest" users by default).

3) Input passed via the "movieName" parameter to swfupload.swf is not properly sanitised before being used.

For more information:
SA49651

4) Certain input related to the edit mode is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

5) Certain Input passed to the Autonav Preview pane is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The weakness, the security issue, and the vulnerabilities are reported in versions prior to 5.6.0.

Solution
Update to version 5.6.0.

Provided and/or discovered by
2) Martin Obiols via Secunia.
1, 4, 5) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.concrete5.org/documentation/background/version_history/5-6-0-release-notes/
https://github.com/LukasReschke/concrete5/commit/f38a0a70cd6f3fd115e960719220221248c198e7

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers