Quick.Cart session fixation, plaintext passwords patched

5 February 2026 medium vulnerability retail

Two vulnerabilities in Quick.Cart e-commerce software allow session hijacking via session fixation and expose user passwords stored in plaintext.

CERT Polska disclosed two vulnerabilities affecting Quick.Cart e-commerce software version 6.7. CVE-2026-23796 is a session fixation vulnerability that allows attackers to set a user's session identifier before authentication, which persists after login, enabling session hijacking. CVE-2026-23797 involves the storage of user passwords in plaintext, allowing high-privileged attackers to view credentials through the user editing interface.

The vendor was notified early in the disclosure process but did not provide details on affected version ranges. Only version 6.7 has been confirmed vulnerable through testing; other versions may also be affected. The vulnerabilities were responsibly reported by security researcher Beniamin Jabłoński.

Organizations running Quick.Cart should immediately verify their version, implement compensating controls for session management, and investigate any unauthorized access to administrative interfaces. The lack of vendor response raises concerns about patch availability and the security posture of deployed instances.

Mentioned in this report

Vulnerabilities CVE-2026-23796CVE-2026-23797

Detection guidance

Possible Session Fixation via Session ID Passed in URL Query String

ATT&CK T1539

Detects HTTP requests where a session identifier (e.g., PHPSESSID) is supplied as a URL query parameter to a login endpoint, a hallmark of session fixation attacks such as CVE-2026-23796 against Quick.Cart, where an attacker pre-sets a victim's session ID before authentication so it persists post-login. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Possible Session Fixation via Session ID in URL Query String
id: 6a4ecdc7-5f4e-5b55-a74a-42e767b92e52
status: experimental
description: 'Detects HTTP requests carrying a session identifier as a URL query string
  parameter targeting a login or authentication endpoint. This pattern is characteristic
  of session fixation attacks (e.g., CVE-2026-23796 in Quick.Cart 6.7), where an attacker
  sets a session ID before the victim authenticates so the session persists and can
  later be hijacked.

  '
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1539
- attack.credential-access
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - PHPSESSID=
    - SESSID=
    - sessionid=
  login_context:
    cs-uri-stem|contains:
    - login
    - signin
    - auth
  filter:
    cs-uri-query|contains:
    - logout
  condition: selection and login_context and not filter
falsepositives:
- Applications that legitimately propagate session IDs via URL for clients with cookies
  disabled
- Load balancer or CDN health checks that append session parameters for testing
level: medium

Suspicious Admin Access to User Edit Endpoint Potentially Exposing Plaintext Passwords

ATT&CK T1555.005

Detects requests to a user-editing administrative endpoint that may expose plaintext stored passwords, matching the pattern disclosed in CVE-2026-23797 where Quick.Cart stores and displays user passwords in cleartext via the admin user editing interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Admin User Edit Endpoint Access Potentially Exposing Plaintext Passwords
id: a04c395b-9215-5143-8631-2f7713499e58
status: experimental
description: 'Detects HTTP requests to administrative user-editing endpoints combined
  with parameters indicating password field retrieval or modification. Relevant to
  CVE-2026-23797 in Quick.Cart, where user passwords are stored in plaintext and can
  be viewed by a high-privileged attacker through the user editing interface. Investigate
  repeated or bulk access patterns to this endpoint by a single account as a possible
  indicator of credential harvesting.

  '
references:
- https://cert.pl
author: Vorant
tags:
- attack.t1555.005
- attack.credential-access
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - admin
  edit_action:
    cs-uri-query|contains:
    - action=edituser
    - action=edit_user
    - editUser
  password_field:
    cs-uri-query|contains:
    - password
    - pass=
  condition: selection and edit_action and password_field
falsepositives:
- Legitimate administrator password reset or account maintenance activity performed
  through the normal admin panel
- Automated account provisioning scripts that set initial passwords via the same endpoint
level: low

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-23796

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free