Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-33384 and CVE-2026-33386) found in QuickCMS software.
Analysis Summary
# Vulnerability: Multiple Flaws in QuickCMS (Session Fixation and XSS)
## CVE Details
- **CVE ID:** CVE-2026-33384, CVE-2026-33386
- **CVSS Score:** Not explicitly provided in the source (Typically High for Session Fixation/MITM XSS)
- **CWE:**
- CWE-384: Session Fixation (CVE-2026-33384)
- CWE-79: Cross-site Scripting (CVE-2026-33386)
## Affected Systems
- **Products:** OpenSolution QuickCMS
- **Versions:** All versions through 6.8 (until the patch released on May 15, 2026)
- **Configurations:** Systems using the default session management and the plugin-fetching mechanism.
## Vulnerability Description
- **CVE-2026-33384 (Session Fixation):** The application allows a user's session identifier to be established prior to authentication. Because this identifier remains unchanged after a successful login, an attacker can pre-set a session ID for a victim and subsequently hijack the session once the victim authenticates.
- **CVE-2026-33386 (Cross-Site Scripting):** The software utilizes an insecure HTTP-based mechanism to fetch plugin lists from the vendor. Because the connection is unencrypted/unauthenticated, an attacker can perform a Man-in-the-Middle (MITM) attack to impersonate `opensolution[.]org` and inject malicious HTML or JavaScript. This content is automatically rendered and executed when an administrator accesses the plugin page.
## Exploitation
- **Status:** Reported via Coordinated Vulnerability Disclosure (CVD); no mention of active exploitation in the wild.
- **Complexity:** Medium (CVE-2026-33386 requires MITM positioning).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Session hijacking and script execution allow access to sensitive data).
- **Integrity:** High (Ability to perform actions on behalf of authenticated users/administrators).
- **Availability:** Medium (Potential for unauthorized configuration changes).
## Remediation
### Patches
- Users should apply the patch for **QuickCMS version 6.8** published on **May 15, 2026**.
- Deployments of version 6.8 created or updated before this date remain vulnerable.
### Workarounds
- **Session Security:** Manually clear session cookies and ensure the application generates a new session ID upon login.
- **Plugin Safety:** Avoid using the automated plugin-fetching interface if on an untrusted network until the patch is applied.
## Detection
- **Indicators of Compromise:**
- Unexpected session activity or multiple logins with the same session ID.
- Unusual outbound HTTP traffic to `opensolution[.]org` (non-HTTPS).
- Presence of unauthorized scripts or unusual HTML elements on the plugin management page.
- **Detection methods:** Web Application Firewalls (WAF) can be configured to detect session fixation patterns and common XSS payloads.
## References
- **Vendor Advisory:** hxxps://opensolution[.]org
- **CERT Polska Advisory:** hxxps://cert[.]pl/en/posts/2026/05/vulnerabilities-in-quickcms/
- **CVE Records:**
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-33384
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-33386