Executive brief
QuickCMS, a content management system used for building websites and online shops, contains a security flaw in how it fetches software plugins. Because the system uses an insecure connection to check for updates, an attacker positioned on the same network can intercept the request and inject malicious code. This could allow an attacker to take control of the administrator's browser session, potentially leading to unauthorized website changes or data theft.
Technical details
QuickCMS is vulnerable to a stored Cross-Site Scripting (XSS) attack stemming from an insecure update/plugin-fetching mechanism. The application communicates with the 'opensolution.org' server over unencrypted HTTP to retrieve plugin lists. A Man-in-the-Middle (MITM) attacker can intercept this traffic and serve a malicious HTML or JavaScript payload. When an administrator accesses the plugin management page within the CMS, the application fetches the remote content and renders it without proper sanitization, leading to the execution of arbitrary script in the context of the user's session. A patch was released on May 15, 2026, for version 6.8 to address this issue.
Affected products
- OpenSolution QuickCMS All versions up to 6.8 (prior to 2026-05-15 patch)
Timeline
- 2026-05-15: patched: Patch for version 6.8 released
- 2026-05-29: advisory: Advisory published by CERT Polska