CVE-2025-54172: Quick.cms Stored XSS Vulnerability

CVE-2025-54172 Overview

CVE-2025-54172 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Opensolution Quick.cms version 6.8. The flaw resides in the sTitle parameter of the page editor functionality. An authenticated attacker with administrator privileges can inject arbitrary HTML and JavaScript that executes when a user visits the edited page. Regular administrator accounts without elevated permissions cannot inject scripts, limiting the attack surface to privileged users. CERT Poland coordinated disclosure, but the vendor did not confirm the full range of affected versions. Only version 6.8 has been tested and confirmed vulnerable.

Critical Impact
A privileged administrator can inject persistent JavaScript into public-facing pages, enabling session theft, credential harvesting, and drive-by attacks against site visitors and other admins.

Affected Products

Opensolution Quick.cms 6.8 (confirmed vulnerable)
Earlier and later Quick.cms versions (untested, potentially vulnerable)
Any Quick.cms deployment exposing the page editor to multiple admin roles

Discovery Timeline

2025-08-20 - CVE-2025-54172 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54172

Vulnerability Analysis

Quick.cms fails to sanitize or encode the sTitle parameter submitted through the page editor. The application stores the raw input and later renders it directly into HTML output when the page is displayed. Any HTML tags or <script> payloads supplied by an attacker execute in the browser context of every visitor to the affected page.

Exploitation requires administrative privileges, which limits mass exploitation. However, multi-admin environments and shared hosting scenarios remain exposed. A malicious or compromised admin account can persist JavaScript that targets higher-privileged users, exfiltrates session cookies, or pivots into browser-based attacks against other administrators.

The vendor was notified but did not disclose which versions outside 6.8 are affected. Organizations running any Quick.cms release should treat the page editor as untrusted until the vendor publishes a fix and clarifies scope.

Root Cause

The root cause is missing output encoding and input validation on the sTitle field within the page editor workflow. Quick.cms trusts input from privileged users and renders stored values without applying HTML entity encoding, violating standard XSS defense guidance for [CWE-79].

Attack Vector

The attack requires network access to the admin panel and valid administrator credentials with page editing rights. The attacker submits crafted HTML or JavaScript in the sTitle field when creating or editing a page. Payload execution occurs when any user, including other administrators or unauthenticated visitors, loads the affected page. See the CERT Poland advisory for CVE-2025-54172 for coordinated-disclosure details.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in prose only, per the CERT Poland advisory.

Detection Methods for CVE-2025-54172

Indicators of Compromise

Unexpected <script>, <img onerror=>, or event-handler HTML in Quick.cms page titles or meta fields.
Admin panel audit entries showing page edits followed by anomalous outbound requests from visitor browsers.
Session cookies or admin credentials appearing in external logs referenced from Quick.cms domains.

Detection Strategies

Inspect the Quick.cms database sTitle column for HTML tags, JavaScript keywords, or URI-encoded payloads.
Deploy Content Security Policy (CSP) violation reporting to surface script executions from unexpected origins.
Correlate admin login events with page editor writes and subsequent client-side errors in web server logs.

Monitoring Recommendations

Enable and forward Quick.cms admin action logs to a centralized SIEM for review.
Alert on any page title containing angle brackets, javascript: URIs, or on*= handler attributes.
Track anomalous administrator activity such as off-hours edits or edits from new IP ranges.

How to Mitigate CVE-2025-54172

Immediate Actions Required

Restrict page editor access to a minimum set of trusted administrators until a vendor patch is available.
Audit existing pages for stored HTML or JavaScript in sTitle and remove any unauthorized content.
Rotate administrator credentials and invalidate active sessions if unauthorized edits are found.
Monitor the Opensolution Quick.cms product page for security updates.

Patch Information

As of the last NVD update on 2026-06-17, Opensolution has not published a specific patched version for CVE-2025-54172. Only version 6.8 has been tested and confirmed vulnerable; other versions may also be affected. Administrators should contact the vendor directly for remediation guidance and upgrade to any release that references this CVE in its changelog.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on public pages rendered by Quick.cms.
Place the admin panel behind IP allowlisting or a VPN to reduce exposure of privileged accounts.
Apply a web application firewall rule that blocks HTML tags and JavaScript keywords in the sTitle request parameter.
Review administrator role assignments and revoke page editing rights from accounts that do not require them.

bash

# Example WAF rule (ModSecurity) blocking HTML/JS in sTitle
SecRule ARGS:sTitle "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1054172,phase:2,deny,status:403,log,msg:'Potential XSS in Quick.cms sTitle (CVE-2025-54172)'"