CVE-2025-54172
📋 TL;DR
QuickCMS is vulnerable to stored cross-site scripting (XSS) in the sTitle parameter of the page editor functionality. An attacker with admin privileges can inject malicious HTML and JavaScript that executes when users visit the edited page. This affects QuickCMS installations where admin accounts could be compromised or misused.
💻 Affected Systems
- QuickCMS
📦 What is this software?
Quick Cms by Opensolution
⚠️ Risk & Real-World Impact
Worst Case
Compromised admin account leads to complete website takeover, credential theft from visitors, malware distribution, or defacement.
Likely Case
Malicious admin injects tracking scripts, redirects, or defaces specific pages affecting user trust.
If Mitigated
With proper admin account security and input validation, impact is limited to minor content manipulation.
🎯 Exploit Status
Exploitation requires admin access. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://opensolution.org/cms-system-quick-cms.html
Restart Required: No
Instructions:
Check vendor website for updates. Since vendor hasn't responded, consider workarounds or alternative CMS.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side filtering of HTML/JS in sTitle parameter
Implement input sanitization in page editor backend code
Content Security Policy
allImplement CSP headers to restrict script execution
Add Content-Security-Policy header to web server configuration
🧯 If You Can't Patch
- Restrict admin account access to trusted personnel only
- Implement web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test if HTML/JS can be injected via sTitle parameter in page editor with admin accountCheck Version:
Check QuickCMS version in admin panel or configuration filesVerify Fix Applied:
Verify injected scripts no longer execute when visiting edited pages📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity in page editor
- Suspicious HTML/JS patterns in page titles
Network Indicators:
- Unexpected script loads from edited pages
SIEM Query:
admin_user:* AND action:"edit_page" AND (title:*<script* OR title:*javascript:* OR title:*onclick*)