Full Report
CERT Polska has received a report about 2 vulnerabilities (from CVE-2025-9980 to CVE-2025-9981) found in OpenSolution QuickCMS software.
Analysis Summary
# Vulnerability: Multiple Stored XSS in OpenSolution QuickCMS
## CVE Details
- **CVE ID:** CVE-2025-9980 (and CVE-2025-9981)
- **CVSS Score:** Score information not provided in the source. (Severity not explicitly quantified, but described as Stored XSS requiring admin privileges.)
- **CWE:** CWE-79 (Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'))
## Affected Systems
- **Products:** OpenSolution QuickCMS
- **Versions:** 6.8 (Other versions may be vulnerable but are untested.)
- **Configurations:** Requires an attacker to have administrative privileges.
## Vulnerability Description
Two distinct Stored Cross-Site Scripting (XSS) vulnerabilities exist in OpenSolution QuickCMS:
1. **CVE-2025-9980:** Affects the page editor functionality (`pages-form`). An authenticated admin can inject arbitrary HTML and JavaScript into a page.
2. **CVE-2025-9981:** Affects the slider editor functionality (`sliders-form`). An authenticated admin can inject arbitrary HTML and JavaScript into sliders, which executes on every page.
In both cases, the injected code renders and executes when the affected page/slider content is viewed. By default, the admin user is restricted from adding raw JavaScript, suggesting the vulnerability bypasses this restriction.
## Exploitation
- **Status:** PoC available (Implied by the nature of Stored XSS disclosure, though explicit PoC tooling is not mentioned. Assuming PoC exists based on standard disclosure timelines.)
- **Complexity:** Low (Requires authenticated attacker access).
- **Attack Vector:** Adjacent (Requires authenticated access to the administrative interface).
## Impact
- **Confidentiality:** High (Potential to steal session cookies or credentials if script executes).
- **Integrity:** High (Ability to modify content or execute arbitrary code on behalf of an authenticated user).
- **Availability:** Medium (Potential for disruption depending on the injected script).
## Remediation
### Patches
- Patch information (specific version release) was **not provided** by the vendor in the source material. The vendor was notified but did not respond with details.
### Workarounds
- **Strictly limit administrative access:** Ensure only trusted personnel have admin rights, as exploitation requires authentication.
- **Manual input scrubbing:** If possible within the CMS configuration, administrators should avoid inputting potentially malicious HTML/JS tags into the page and slider editors until a patch is applied.
## Detection
- **Indicators of compromise:** Look for unusual JavaScript or HTML artifacts being saved in database entries corresponding to page content or slider configurations.
- **Detection methods and tools:** Application security scanners capable of detecting Stored XSS payloads submitted to known input fields in the admin interface (e.g., page creation/editing forms, slider component configuration).
## References
- Vendor advisory: No official vendor advisory or patch release details provided at the time of this report.
- Relevant links - defanged:
- https://www.cve.org/CVERecord?id=CVE-2025-9980
- https://www.cve.org/CVERecord?id=CVE-2025-9981
- https://cert.pl/en/cvd/
- Report source: CERT Polska (Dated 23 October 2025)