Executive brief
Quick.Cart is a PHP-based shopping cart script used to build online stores. A security flaw exists where the software stores administrative login credentials in plain text within a configuration file on the server. If an unauthorized person gains access to the server's file system, they can read these credentials and take full control of the online store.
Technical details
Quick.Cart (tested in version 6.7, but affecting all versions) suffers from CWE-256: Plaintext Storage of a Password. The application stores hard-coded administrative credentials in a configuration file on the server's file system without encryption or hashing. An attacker with local access to the server's file system (e.g., via a separate vulnerability or compromised low-privileged account) can retrieve these credentials to gain full administrative access to the web application. The vendor has stated they do not intend to release a fix, as they consider the likelihood of exploitation to be very low.
Affected products
- OpenSolution Quick.Cart All versions up to and including 6.7
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed by CERT.PL
- 2026-07-28: advisory: CVE-2026-41874 published