QuickCMS is vulnerable to Cross-Site Request Forgery in its article creation functionality. A malicious attacker can craft a special website that, when visited by an admin, will automatically send a POST request to create a malicious article with content defined by the attacker. The vendor was notified of this vulnerability but did not respond with details or a vulnerable version range.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-54174 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious website that, when accessed by an admin user of QuickCMS, will trigger a POST request to the server. This request will create an article with content specified by the attacker, effectively allowing them to manipulate the site’s content without authorization.
Affected Products
- QuickCMS 6.8 – Confirmed vulnerable version that allows for Cross-Site Request Forgery in article creation.
- Other versions may also be vulnerable but have not been tested.
Mitigation
To mitigate this vulnerability, it is recommended that QuickCMS implement anti-CSRF tokens in their article creation functionality to ensure that requests are legitimate and originate from authenticated users. Additionally, users should be cautious about visiting untrusted websites while logged into their admin accounts.