CVE-2025-9980: Quick.cms Stored XSS Vulnerability

CVE-2025-9980 Overview

CVE-2025-9980 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the OpenSolution Quick.CMS page editor. The flaw resides in the pages-form functionality of the administrative interface. An authenticated attacker with administrator privileges can inject arbitrary HTML and JavaScript into edited pages. The injected payload executes in the browser of any visitor who loads the affected page.

By default, administrators cannot add JavaScript into the site, which makes this an explicit bypass of the CMS security model. Version 6.8 has been tested and confirmed vulnerable, and other versions may also be affected.

Critical Impact
A privileged attacker or a compromised administrator account can persistently execute JavaScript in the context of every visitor, enabling session theft, credential harvesting, or client-side redirection.

Affected Products

OpenSolution Quick.CMS 6.8 (confirmed)
Earlier and later Quick.CMS versions (untested, potentially vulnerable)
Deployments exposing the pages-form administrative endpoint

Discovery Timeline

2025-10-23 - CVE-2025-9980 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9980

Vulnerability Analysis

Quick.CMS enforces a security control that prevents administrators from inserting <script> blocks and other JavaScript-executing markup through the page editor. The pages-form component fails to consistently apply this control across all input paths. As a result, an administrator can submit page content containing HTML and JavaScript that survives sanitization and is later rendered verbatim to end users.

Because the payload is persisted to the CMS data store, every visitor to the modified page triggers execution. The impact aligns with a classic stored XSS pattern: the vulnerability targets integrity and confidentiality of the visitor session rather than the server itself. Attackers can steal session cookies, pivot to other administrators, deface content client-side, or serve malicious redirects.

The vendor did not confirm a vulnerable version range, so defenders should treat all Quick.CMS deployments as potentially affected until proven otherwise. Full technical write-up is available in the CERT Polska advisory for CVE-2025-9980.

Root Cause

The root cause is insufficient output encoding and incomplete input validation in the pages-form editor workflow. The sanitizer that normally strips script-bearing HTML from administrator-submitted content does not cover all fields or all injection contexts. Content flows from the database to the rendered page without contextual escaping, so injected markup executes when the page loads in a browser.

Attack Vector

Exploitation requires an authenticated session with administrator privileges and user interaction on the victim side (loading the affected page). The attacker uses the standard page editor UI, or a crafted HTTP request against pages-form, to submit a page that contains an HTML or JavaScript payload. Once saved, the payload is served to every visitor of that page. The scenario also becomes relevant when an administrator account is compromised through phishing or credential reuse, converting a single account takeover into persistent client-side compromise for all site visitors.

No public proof-of-concept exploit code is available. See the CERT Polska advisory for CVE-2025-9980 for the vendor coordination details.

Detection Methods for CVE-2025-9980

Indicators of Compromise

Page records in the Quick.CMS database whose content fields contain <script>, onerror=, onload=, javascript:, or base64-encoded payloads.
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from CMS-hosted pages.
Administrator sessions performing POST requests to pages-form from unusual IP addresses or at unusual hours.

Detection Strategies

Diff stored page content against a known-good baseline and alert on any HTML tags outside the CMS whitelist.
Monitor web server access logs for POST requests to the administrative page editor and correlate with subsequent GET traffic containing script indicators.
Deploy a Content Security Policy (CSP) with reporting enabled to surface inline-script violations on public pages.

Monitoring Recommendations

Audit the Quick.CMS administrator account list and enforce strong authentication on all privileged accounts.
Log and review all changes made through pages-form, including author, timestamp, and source IP.
Alert on any modification to publicly served pages that introduces <script>, event-handler attributes, or iframe tags.

How to Mitigate CVE-2025-9980

Immediate Actions Required

Restrict administrative access to the Quick.CMS backend using IP allowlists, VPN, or a reverse proxy with authentication.
Review all existing pages in the CMS for injected script content and remove any unauthorized markup.
Rotate credentials and session tokens for all administrator accounts if any compromise is suspected.
Enable multi-factor authentication on the administrative interface where the deployment supports it.

Patch Information

No vendor patch or fixed version has been published in the NVD entry or referenced advisory. The vendor did not respond with a vulnerable version range during coordinated disclosure. Track updates on the OpenSolution product page and the CERT Polska advisory for CVE-2025-9980 for a fix release.

Workarounds

Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Place a web application firewall in front of Quick.CMS with rules that block script tags and event handlers in pages-form submissions.
Limit administrator accounts to trusted personnel and remove unused privileged accounts.
Serve the administrative interface only over authenticated, network-restricted paths.

bash

# Example Content Security Policy header for the public site
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report