Full Report
CERT Polska has received a report about 3 vulnerabilities (CVE-2025-54172, CVE-2025-54174 and CVE-2025-54175) found in OpenSolution Quick.CMS and Quick.CMS.Ext software.
Analysis Summary
This summary consolidates the details for the three vulnerabilities reported in OpenSolution Quick.CMS and Quick.CMS.Ext software.
# Vulnerability: Multiple Flaws in OpenSolution Quick.CMS and Quick.CMS.Ext
## CVE Details
| CVE ID | Severity Score (Inferred/Not Provided) | CWE |
| :--- | :--- | :--- |
| CVE-2025-54172 | N/A (XSS) | CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS)) |
| CVE-2025-54174 | N/A (CSRF) | CWE-352 (Cross-Site Request Forgery (CSRF)) |
| CVE-2025-54175 | N/A (XSS) | CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS)) |
## Affected Systems
- **Products:** OpenSolution Quick.CMS, OpenSolution Quick.CMS.Ext
- **Versions:** Version 6.8 confirmed vulnerable. Other versions were not tested but may also be affected.
- **Configurations:**
* CVE-2025-54172: Affects page editor functionality. Requires admin privileges, but regular admin users might have limitations on JS injection (not specified if this fully mitigates risk).
* CVE-2025-54174: Affects article creation functionality.
* CVE-2025-54175: Affects thumbnail viewer functionality.
## Vulnerability Description
1. **CVE-2025-54172 (Stored XSS in Quick.CMS):** An authenticated attacker with administrative privileges can inject arbitrary HTML and JavaScript into the `sTitle` parameter when editing a page. This payload executes when the edited page is visited.
2. **CVE-2025-54174 (CSRF in Quick.CMS):** An attacker can craft a malicious website that, when visited by an authenticated administrator, forces the browser to execute a POST request. This request can automatically create a malicious article containing attacker-defined content.
3. **CVE-2025-54175 (Reflected XSS in Quick.CMS.Ext):** An attacker can craft a malicious URL targeting the `sFileName` parameter in the thumbnail viewer. If a victim opens this URL, arbitrary JavaScript executes in their browser.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild, but PoC availability is implied by the detailed reports.
- **Complexity:**
* CVE-2025-54172/54175 (XSS): Likely Low/Medium, depending on necessary privileges.
* CVE-2025-54174 (CSRF): Low, targets already authenticated users.
- **Attack Vector:** Network (via crafted URL or webpage).
## Impact
Since CVSS scores and severity assessments were not provided in the source material, impact is inferred based on vulnerability type:
- **Confidentiality:** High (XSS can lead to session hijacking or data exfiltration).
- **Integrity:** High (CSRF allows unauthorized data modification/creation; XSS allows code execution).
- **Availability:** Potential impact depending on the injected payload.
## Remediation
### Patches
- The vendor (OpenSolution) was notified but did not provide details on vulnerable versions or release patches at the time of the report (August 2025). **No specific patch versions are available based on this source.**
### Workarounds
- Changing the default path leading to the admin panel makes exploitation *harder* but not impossible for the disclosed vulnerabilities.
- For CVE-2025-54172, the note suggests regular admin users might have limitations on JS injection, but this should not be relied upon for remediation.
## Detection
- **Indicators of compromise:** Uncharacteristic scripts executing in the browser context of site visitors (for XSS payloads), or unexpected articles appearing in the content list (for CSRF).
- **Detection methods and tools:** Web Application Firewalls (WAF) configured to detect XSS payloads in request parameters or scanning tools capable of identifying CSRF tokens absence or input validation bypasses. Given the flaws are in specific parameters (`sTitle`, `sFileName`), monitoring these input sources is key.
## References
- Vendor advisories: None provided by the vendor in the source text.
- Relevant links:
* hXXps://incydent.cert.pl/#!/lang=en
* hXXps://cert.pl/en/publications/
* hXXps://cert.pl/en/cvd/