Executive brief
QuickCMS is a lightweight content management system used to create websites. The software lacks CSRF protection on form submissions, allowing attackers to craft malicious websites that can trick administrators into unwittingly performing actions (such as creating or modifying content) when they visit the attacker's page. This could lead to unauthorized content changes or administrative actions performed without the user's knowledge.
Technical details
QuickCMS contains a Cross-Site Request Forgery (CSRF / CWE-352) vulnerability affecting multiple form endpoints throughout the application. The vulnerability exists because the software does not implement anti-CSRF tokens or other protections to validate that form submissions originate from legitimate users. An attacker can create a malicious website containing hidden forms that, when visited by an authenticated administrator, automatically submit POST requests using the victim's browser session and privileges. All form submissions in QuickCMS versions prior to 6.8 are potentially vulnerable. The vendor released a patch in version 6.8 on May 14, 2026 that addresses this issue.
Affected products
- OpenSolution QuickCMS prior to 6.8
Timeline
- 2026-03-06: disclosed
- 2026-05-14: patched: Version 6.8 released with patch