Executive brief
OpenSolution Quick.CMS, a content management system used for building websites, contains a security flaw in how it handles data sent to the administrator panel. Because the system processes unencrypted information sent over the network without verifying its authenticity, an attacker on the same network can intercept and modify this data. This could allow an attacker to take complete control of the web server and execute unauthorized commands when an administrator logs in.
Technical details
Quick.CMS (up to version 6.8) is vulnerable to insecure deserialization (CWE-502) because it processes serialized data received via plaintext HTTP without integrity checks. An attacker positioned to perform a Man-in-the-Middle (MitM) attack can intercept the traffic and inject malicious PHP objects. Since the application lacks class whitelisting during deserialization, these objects can trigger magic methods like __wakeup() or __destruct() to initiate gadget chains. This leads to arbitrary code execution (RCE) on the server. The vulnerability is triggered automatically when an administrator accesses the management panel. A patch was released on May 14, 2026, which mitigates the issue by enforcing HTTPS communication.
Affected products
- OpenSolution Quick.CMS All versions up to 6.8 (prior to 2026-05-14 patch)
Timeline
- 2026-05-14: patched: Patch released for version 6.8 enforcing HTTPS
- 2026-06-15: advisory: Advisory published by CERT.PL and NVD