Executive brief
Quick.CMS, a content management system used for building websites, contains a security flaw in its administrative slider management tool. An attacker can trick a logged-in administrator into clicking a malicious link, which then executes unauthorized code in their browser. This could allow the attacker to steal session cookies, hijack administrative accounts, or modify website content.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Quick.CMS 6.7 within the 'sliders' administrative form. The root cause is improper neutralization of input in the 'sDescription' parameter at the 'admin.php?p=sliders-form' endpoint. While the vulnerability requires authentication to exploit directly, it can also be triggered via Cross-Site Request Forgery (CSRF) by tricking an authenticated user into submitting a malicious form. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. Version 6.8 has been released by the vendor which may address these issues.
Affected products
- OpenSolution Quick.CMS 6.7
Timeline
- 2021-04-21: disclosed: Initial discovery and exploit development by researcher
- 2021-11-17: other: Exploit published on Exploit-DB
- 2025-04-24: patched: Vendor released version 6.8
- 2026-05-16: advisory: CVE published to NVD