Full Report
CERT Polska has received a report about 6 vulnerabilities (from CVE-2025-54540 to CVE-2025-55175) found in OpenSolution QuickCMS software.
Analysis Summary
This summary covers six reported vulnerabilities in OpenSolution QuickCMS software coordinated by CERT Polska. Note that CVSS scores and specific exploitation details were not provided in the source material for all CVEs, and specific patch details are currently unavailable.
---
# Vulnerability: Multiple Flaws in OpenSolution QuickCMS (Including XSS and CSRF)
## CVE Details (Grouped by Type)
| CVE ID | CWE | Description Snippet | CVSS Score | Severity |
| :--- | :--- | :--- | :--- | :--- |
| CVE-2025-54540 | CWE-79 (XSS) | Reflected XSS via `sSort` parameter in admin panel. | N/A | N/A |
| CVE-2025-54541 | CWE-352 (CSRF) | Cross-Site Request Forgery in page deletion functionality. | N/A | N/A |
| CVE-2025-54542 | CWE-598 | Use of GET Request Method containing credentials (login/password). | N/A | N/A |
| CVE-2025-54543 | CWE-79 (XSS) | Stored XSS via `sDescriptionMeta` parameter in page editor SEO. | N/A | N/A |
| CVE-2025-54544 | CWE-79 (XSS) | Stored XSS via `aDirFilesDescriptions` parameter in files editor. | N/A | N/A |
| CVE-2025-55175 | CWE-79 (XSS) | Reflected XSS via `sLangEdit` parameter in admin panel. | N/A | N/A |
## Affected Systems
- **Products:** OpenSolution QuickCMS
- **Versions:** Version 6.8 (Confirmed vulnerable. Other versions may also be affected as the vendor did not specify a full vulnerable range.)
- **Configurations:** Exploitation of most flaws requires administrative access or relies on an authenticated admin user visiting a malicious link.
## Vulnerability Description
This advisory details six vulnerabilities affecting QuickCMS version 6.8:
1. **Reflected XSS (CVE-2025-54540, CVE-2025-55175):** Flaws in admin panel functions (`sSort`, `sLangEdit`) allow an attacker to craft a malicious URL, leading to arbitrary JavaScript execution in the victim's browser when the admin opens it.
2. **CSRF (CVE-2025-54541):** An attacker can force an authenticated admin user to perform an unintended action (page deletion) by visiting a specially crafted website.
3. **Credential Exposure via GET (CVE-2025-54542):** The software transmits login credentials (username and password) over insecure GET requests, exposing them in browser history to local attackers.
4. **Stored XSS (CVE-2025-54543, CVE-2025-54544):** Flaws in SEO metadata (`sDescriptionMeta`) and file descriptions (`aDirFilesDescriptions`) allow an attacker with admin privileges to inject arbitrary HTML/JS. This payload executes when other users (including admins) visit the compromised page.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild, but Proof-of-Concept (PoC) material is often correlated with such disclosures. XSS and CSRF are generally easy to weaponize.
- **Complexity:** Medium (Requires authenticated user interaction for some flaws, but local exploitation for credential exposure.)
- **Attack Vector:** Network (Requires interaction), Adjacent (If credentials are stolen via history).
## Impact
| Category | Impact Level (Based on vulnerability type) |
| :--- | :--- |
| Confidentiality | High (Credential exposure possible via CVE-2025-54542) |
| Integrity | High (Stored XSS allows content modification; CSRF allows unauthorized deletion) |
| Availability | Low to Medium (Potential for disruption via unauthorized actions) |
## Remediation
### Patches
- **Status:** No specific patch version information was provided in the summary data. Users must contact OpenSolution or check official vendor advisory channels for patched firmware/software releases.
### Workarounds
- Strictly limit administrative access to the QuickCMS back-end.
- **For CVE-2025-54542:** Advise administrators to use secure, non-remembered login sessions and avoid reusing credentials.
- **For Stored XSS:** If possible, sanitize or restrict the use of HTML/JavaScript input fields in the admin interface until patched.
## Detection
- **Indicators of Compromise:** Look for unusual HTTP requests containing parameters like `sSort`, `sLangEdit`, `sDescriptionMeta`, or `aDirFilesDescriptions` that contain web shells or scripting payloads (`<script>`, `onerror`, etc.).
- **Detection Methods and Tools:** Web Application Firewalls (WAFs) should be configured to block common XSS and CSRF patterns across request headers and query strings. Monitor HTTP logs for successful POST requests initiated unexpectedly against resource deletion endpoints.
## References
- Vendor Advisories: None provided in the source text, as the vendor reportedly was not responsive regarding details.
- Relevant Links:
- CERT Polska Advisory Source: hxxps://cert.pl/en/news/
- CVE Record for CVE-2025-54540: hxxps://www.cve.org/CVERecord?id=CVE-2025-54540 (Check for updates on other CVEs listed.)