CVE-2021-47981: Quick.CMS 6.7 XSS Vulnerability

CVE-2021-47981 Overview

CVE-2021-47981 is a cross-site scripting (XSS) vulnerability in Quick.CMS 6.7, an open-source content management system developed by OpenSolution. The flaw resides in the sliders form functionality accessible through the admin.php?p=sliders-form endpoint. Attackers can inject malicious JavaScript payloads through the sDescription parameter, which the application stores and renders without proper sanitization. The vulnerability is exploitable through a cross-site request forgery (CSRF) attack chain, allowing remote attackers to craft external forms that trigger script execution when an authenticated administrator submits them. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated administrators can be tricked into executing attacker-controlled JavaScript in their browser session, enabling session theft, admin panel manipulation, and further compromise of the CMS.

Affected Products

OpenSolution Quick.CMS version 6.7
Quick.CMS administrative sliders-form module
Installations exposing admin.php to untrusted networks

Discovery Timeline

2026-05-16 - CVE-2021-47981 published to the National Vulnerability Database
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47981

Vulnerability Analysis

The vulnerability stems from missing input sanitization on the sDescription parameter in the Quick.CMS slider configuration form. The application accepts arbitrary HTML and JavaScript content submitted to admin.php?p=sliders-form and reflects it back without encoding. Because the endpoint lacks anti-CSRF tokens, an attacker can host a malicious form on an external site that auto-submits to the victim's Quick.CMS instance. When an authenticated administrator visits the attacker-controlled page, the browser issues the cross-origin request using existing admin credentials. The injected payload then executes within the trusted origin of the CMS administrative interface.

Root Cause

Two defects combine to enable exploitation. First, the sDescription field undergoes no output encoding before being rendered in administrative pages. Second, the sliders form endpoint accepts state-changing POST requests without validating a CSRF token or verifying the request origin. The intersection of stored XSS and missing CSRF protections amplifies the impact beyond a standard reflected XSS issue.

Attack Vector

An attacker hosts an HTML page containing a hidden form targeting admin.php?p=sliders-form with a crafted sDescription value carrying a JavaScript payload. The attacker delivers the link through phishing or by embedding it on a controlled site. When an authenticated Quick.CMS administrator loads the page, the form auto-submits via JavaScript. The CMS processes the request, stores the payload, and executes it when admin pages render the slider data. Public proof-of-concept details are available at Exploit-DB #50530 and the VulnCheck advisory.

Detection Methods for CVE-2021-47981

Indicators of Compromise

POST requests to admin.php?p=sliders-form originating from external Referer headers or cross-origin contexts
Slider records in the Quick.CMS database containing <script>, onerror, onload, or javascript: strings in the sDescription column
Unexpected administrator account creation or privilege changes following slider form submissions
Outbound requests from admin browsers to unfamiliar domains shortly after accessing the sliders module

Detection Strategies

Inspect web server access logs for POST requests to the sliders-form endpoint with payloads containing HTML tags or JavaScript event handlers
Deploy a web application firewall rule that flags submissions to admin.php containing script-related keywords in form parameters
Run periodic database queries against slider tables to identify entries containing markup or encoded script content

Monitoring Recommendations

Enable logging of HTTP Referer and Origin headers on administrative endpoints to identify cross-site submissions
Monitor admin session activity for anomalous JavaScript-driven actions such as rapid configuration changes
Alert on any modification to slider records outside of expected administrative maintenance windows

How to Mitigate CVE-2021-47981

Immediate Actions Required

Restrict access to admin.php using IP allowlists or VPN-only access until a patched version is deployed
Audit existing slider entries in the database and remove any records containing HTML or script content
Require administrators to log out of Quick.CMS sessions before browsing untrusted sites

Patch Information

No vendor patch is referenced in the available advisory data. Users should consult the OpenSolution homepage for the latest Quick.CMS release and apply any version newer than 6.7 once a fix is published. The VulnCheck advisory tracks remediation status.

Workarounds

Implement a reverse proxy rule that strips or rejects POST requests to admin.php?p=sliders-form lacking a same-origin Referer header
Add a Content Security Policy (CSP) header on Quick.CMS responses that disallows inline scripts in the admin interface
Apply server-side input filtering at the web server or WAF layer to strip HTML tags from the sDescription parameter
Enforce SameSite=Strict on Quick.CMS session cookies to reduce CSRF exposure

bash

# Example nginx configuration to block cross-origin POSTs to the vulnerable endpoint
location = /admin.php {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-cms-domain\.tld/") {
            return 403;
        }
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header Set-Cookie "PATH=/; SameSite=Strict; HttpOnly; Secure";
}