CVE-2025-54543: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in OpenSolution QuickCMS
QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
AI Analysis
Technical Summary
CVE-2025-54543 is a stored Cross-Site Scripting (XSS) vulnerability identified in OpenSolution's QuickCMS version 6.8. The vulnerability arises from improper neutralization of input during web page generation, specifically via the sDescriptionMeta parameter used in the page editor's SEO functionality. An attacker with administrative privileges can inject arbitrary HTML and JavaScript code into the website content through this parameter. When a user visits the affected page, the malicious script executes in their browser context. Although the default admin user is restricted from adding JavaScript directly, the vulnerability still allows injection through the SEO metadata field, which is insufficiently sanitized. The vendor was notified early but did not disclose detailed information about the vulnerability or the full range of affected versions. Only version 6.8 has been confirmed vulnerable, but other versions may also be affected. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and user interaction needed. No known exploits are currently in the wild. This vulnerability falls under CWE-79, indicating improper input neutralization leading to XSS. Stored XSS can enable session hijacking, defacement, phishing, or malware distribution by executing malicious scripts in users' browsers within the context of the trusted site.
Potential Impact
For European organizations using QuickCMS 6.8, this vulnerability poses a moderate risk. Since exploitation requires admin privileges, the threat is somewhat limited to insiders or attackers who have already compromised admin accounts. However, successful exploitation can lead to significant impacts including theft of user credentials, session tokens, or sensitive data, as well as potential defacement or redirection to malicious sites. This can damage organizational reputation, lead to regulatory non-compliance under GDPR due to data breaches, and cause operational disruptions. Given that QuickCMS is a content management system, organizations relying on it for public-facing websites or intranet portals could see their users targeted by phishing or malware campaigns leveraging the injected scripts. The lack of vendor response and absence of patches increases the risk of exploitation over time. The medium CVSS score reflects moderate impact and exploitability, but the requirement for admin privileges and user interaction reduces the overall threat level. Nonetheless, European entities should treat this vulnerability seriously, especially those in sectors with high regulatory scrutiny or public visibility.
Mitigation Recommendations
1. Immediately audit and restrict admin access to QuickCMS to trusted personnel only, enforcing strong authentication and monitoring for suspicious activity. 2. Implement web application firewall (WAF) rules to detect and block suspicious input patterns targeting the sDescriptionMeta parameter. 3. Sanitize and validate all input fields rigorously, especially SEO metadata, to neutralize HTML and JavaScript content before storage and rendering. 4. If possible, disable or limit the use of the SEO metadata editing feature until a vendor patch or official fix is available. 5. Monitor website content for unauthorized changes or injected scripts using automated scanning tools. 6. Educate administrators about the risks of XSS and safe content editing practices. 7. Consider isolating the CMS environment or deploying Content Security Policy (CSP) headers to restrict script execution origins and reduce impact of injected scripts. 8. Engage with the vendor for updates or patches and track vulnerability disclosures for new information. 9. Regularly back up website content to enable quick restoration if defacement occurs.
Affected Countries
Germany, France, United Kingdom, Italy, Spain, Netherlands, Poland, Belgium, Sweden, Austria
CVE-2025-54543: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in OpenSolution QuickCMS
Description
QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
AI-Powered Analysis
Technical Analysis
CVE-2025-54543 is a stored Cross-Site Scripting (XSS) vulnerability identified in OpenSolution's QuickCMS version 6.8. The vulnerability arises from improper neutralization of input during web page generation, specifically via the sDescriptionMeta parameter used in the page editor's SEO functionality. An attacker with administrative privileges can inject arbitrary HTML and JavaScript code into the website content through this parameter. When a user visits the affected page, the malicious script executes in their browser context. Although the default admin user is restricted from adding JavaScript directly, the vulnerability still allows injection through the SEO metadata field, which is insufficiently sanitized. The vendor was notified early but did not disclose detailed information about the vulnerability or the full range of affected versions. Only version 6.8 has been confirmed vulnerable, but other versions may also be affected. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and user interaction needed. No known exploits are currently in the wild. This vulnerability falls under CWE-79, indicating improper input neutralization leading to XSS. Stored XSS can enable session hijacking, defacement, phishing, or malware distribution by executing malicious scripts in users' browsers within the context of the trusted site.
Potential Impact
For European organizations using QuickCMS 6.8, this vulnerability poses a moderate risk. Since exploitation requires admin privileges, the threat is somewhat limited to insiders or attackers who have already compromised admin accounts. However, successful exploitation can lead to significant impacts including theft of user credentials, session tokens, or sensitive data, as well as potential defacement or redirection to malicious sites. This can damage organizational reputation, lead to regulatory non-compliance under GDPR due to data breaches, and cause operational disruptions. Given that QuickCMS is a content management system, organizations relying on it for public-facing websites or intranet portals could see their users targeted by phishing or malware campaigns leveraging the injected scripts. The lack of vendor response and absence of patches increases the risk of exploitation over time. The medium CVSS score reflects moderate impact and exploitability, but the requirement for admin privileges and user interaction reduces the overall threat level. Nonetheless, European entities should treat this vulnerability seriously, especially those in sectors with high regulatory scrutiny or public visibility.
Mitigation Recommendations
1. Immediately audit and restrict admin access to QuickCMS to trusted personnel only, enforcing strong authentication and monitoring for suspicious activity. 2. Implement web application firewall (WAF) rules to detect and block suspicious input patterns targeting the sDescriptionMeta parameter. 3. Sanitize and validate all input fields rigorously, especially SEO metadata, to neutralize HTML and JavaScript content before storage and rendering. 4. If possible, disable or limit the use of the SEO metadata editing feature until a vendor patch or official fix is available. 5. Monitor website content for unauthorized changes or injected scripts using automated scanning tools. 6. Educate administrators about the risks of XSS and safe content editing practices. 7. Consider isolating the CMS environment or deploying Content Security Policy (CSP) headers to restrict script execution origins and reduce impact of injected scripts. 8. Engage with the vendor for updates or patches and track vulnerability disclosures for new information. 9. Regularly back up website content to enable quick restoration if defacement occurs.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2025-07-24T13:28:55.489Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68b02cccad5a09ad006bf57e
Added to database: 8/28/2025, 10:17:48 AM
Last enriched: 8/28/2025, 10:33:16 AM
Last updated: 8/28/2025, 10:33:16 AM
Views: 2
Related Threats
CVE-2025-9376: CWE-863 Incorrect Authorization in sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
MediumCVE-2025-55175: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in OpenSolution QuickCMS
MediumCVE-2025-54544: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in OpenSolution QuickCMS
MediumCVE-2025-54542: CWE-598 Use of GET Request Method With Sensitive Query Strings in OpenSolution QuickCMS
MediumCVE-2025-54541: CWE-352 Cross-Site Request Forgery (CSRF) in OpenSolution QuickCMS
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.