QuickCMS is vulnerable to Stored XSS in the sTitle parameter within the page editor functionality. A malicious attacker with admin privileges can inject arbitrary HTML and JavaScript into the website, which will be executed when visiting the edited page. Regular admin users cannot inject any JavaScript scripts into the page. The vendor was notified about this vulnerability but did not provide details on the vulnerable version range.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-54172 |
Exploitation
To exploit this vulnerability, an attacker with admin privileges can access the page editor functionality and inject malicious HTML or JavaScript code into the sTitle parameter. Once the page is saved, any user visiting the edited page will have the injected code executed in their browser, potentially leading to data theft or session hijacking.
Affected Products
- QuickCMS 6.8: This version has been confirmed as vulnerable to the Stored XSS issue.
- Other versions: While only version 6.8 was tested, other versions may also be vulnerable but have not been confirmed.
Mitigation
To mitigate this vulnerability, it is recommended that QuickCMS users upgrade to a patched version as soon as it becomes available. Additionally, restricting admin privileges and implementing input validation can help prevent the injection of malicious scripts.