| CVE ID | CVE-2025-54172 |
| Publication date | 20 August 2025 |
| Vendor | OpenSolution |
| Product | Quick.CMS |
| Vulnerable versions | 6.8 |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-54174 |
| Publication date | 20 August 2025 |
| Vendor | OpenSolution |
| Product | Quick.CMS |
| Vulnerable versions | 6.8 |
| Vulnerability type (CWE) | Cross-Site Request Forgery (CSRF) (CWE-352) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-54175 |
| Publication date | 20 August 2025 |
| Vendor | OpenSolution |
| Product | Quick.CMS.Ext |
| Vulnerable versions | 6.8 |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in OpenSolution Quick.CMS and Quick.CMS.Ext software and participated in coordination of their disclosure.
The vulnerability CVE-2025-54172: Quick.CMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. Regular admin user is not able to inject any JS scripts into the page.
The vulnerability CVE-2025-54174: Quick.CMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious article with content defined by the attacker.
The vulnerability CVE-2025-54175: Quick.CMS.Ext is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in arbitrary JavaScript execution in the victim's browser when opened.
Changing the default path leading to an admin panel (as advised during installation process), makes exploitation of these vulnerabilities harder, but not impossible.
The vendor was notified early about these vulnerabilities, but didn't respond with any details or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Credits
We thank Kamil Szczurowski and Robert Kruczek for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.