Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-9982 and CVE-2025-10018) found in OpenSolution QuickCMS software.
Analysis Summary
This summary covers two vulnerabilities reported in OpenSolution QuickCMS software.
# Vulnerability: QuickCMS Plaintext Password Storage and Stored XSS
## CVE Details
- CVE ID: CVE-2025-9982
- CVSS Score: N/A (Score not provided) (Severity: N/A)
- CWE: CWE-256 (Plaintext Storage of a Password)
- CVE ID: CVE-2025-10018
- CVSS Score: N/A (Score not provided) (Severity: N/A)
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'))
## Affected Systems
- Products: OpenSolution QuickCMS
- Versions: 6.8 (Other versions may also be vulnerable as they were not tested)
- Configurations: N/A
## Vulnerability Description
**CVE-2025-9982:** Sensitive administrator credentials are hardcoded in a configuration file and stored in plaintext within QuickCMS version 6.8. This allows an attacker with access to the source code or server file system to retrieve these authentication details.
**CVE-2025-10018:** QuickCMS version 6.8 is vulnerable to multiple Stored Cross-Site Scripting (XSS) flaws within the language editor functionality (`languages`). A malicious administrator can inject arbitrary HTML/JavaScript that will be rendered and executed on every page view.
## Exploitation
- Status: PoC available (Implied, as technical flaws are detailed, though explicit PoC status is not given for CVE-2025-9982, Stored XSS often implies proof of concept exists.)
- Complexity: Medium (CVE-2025-9982 requires file system access; CVE-2025-10018 requires admin privileges)
- Attack Vector: Varies (File system access for CVE-2025-9982; Internal network/authenticated access for CVE-2025-10018)
## Impact
- Confidentiality: High (Exposure of administrative credentials - CVE-2025-9982)
- Integrity: High (Injection of arbitrary code/content via Stored XSS - CVE-2025-10018)
- Availability: Low/Medium (Depending on the XSS payload)
## Remediation
### Patches
- The vendor (OpenSolution) was notified but reportedly did not respond with details of the full vulnerability scope or patch information as of the report date. **No specific patch versions are currently listed in the provided context.** Users must seek official guidance from OpenSolution.
### Workarounds
- **For CVE-2025-9982:** Restrict file system access to configuration files containing hardcoded credentials.
- **For CVE-2025-10018:** Limit administrative access to the language editor functionality until a patch is available, although the vulnerability relies on an administrative user performing the injection.
## Detection
- **Indicators of Compromise:** Monitoring file system access logs for unexpected reads on configuration files. Monitoring for unauthorized injection of scripts or HTML tags via administrative interfaces related to language settings.
- **Detection Methods and Tools:** File integrity monitoring (FIM) on configuration files; Network traffic analysis for unusual script execution patterns originating from the server.
## References
- Vendor advisories: Vendor notification occurred, but patch details were not provided in the source article.
- Relevant links:
- hXXps://www.cve.org/CVERecord?id=CVE-2025-9982
- hXXps://www.cve.org/CVERecord?id=CVE-2025-10018
- hXXps://cert.pl/en/cvd/ (CERT Polska CVD process)