QuickCMS is vulnerable to Stored XSS in the sTitle parameter within the page editor functionality. A malicious attacker with admin privileges can inject arbitrary HTML and JavaScript into the website, which will be executed when visiting the edited page. Regular admin users cannot inject any JavaScript scripts into the page. The vendor was notified about this vulnerability but did not respond with details or a vulnerable version range.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-54172 |
Exploitation
To exploit this vulnerability, an attacker with admin privileges can access the page editor functionality and inject malicious HTML or JavaScript code into the sTitle parameter. Once the page is saved, any user visiting the edited page will have the injected code executed in their browser, potentially leading to data theft or session hijacking.
Affected Products
- QuickCMS 6.8: Confirmed vulnerable version that allows for Stored XSS through the page editor.
Mitigation
To mitigate this vulnerability, it is recommended that QuickCMS users upgrade to a patched version as soon as it becomes available. Additionally, restricting admin privileges and implementing input validation can help prevent such attacks.