QuickCMS session fixation and XSS enable hijacking attacks
QuickCMS version 6.8 and earlier contains session fixation and XSS vulnerabilities allowing session hijacking and code execution via MITM attacks.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of two vulnerabilities in QuickCMS software reported by security researcher Jakub Lipiński. CVE-2026-33384 is a session fixation vulnerability where an attacker can set a session identifier before authentication that persists after login, enabling session hijacking attacks. CVE-2026-33386 is a cross-site scripting vulnerability exploitable through QuickCMS's insecure HTTP-based plugin fetching mechanism, allowing attackers to conduct man-in-the-middle attacks by impersonating the opensolution.org server and injecting malicious HTML or JavaScript that executes when administrators access the plugin page.
Both vulnerabilities were patched in QuickCMS version 6.8 released on May 15, 2026. Organizations running unpatched versions remain vulnerable to these attacks. The session fixation issue requires an attacker to social engineer a victim into using a predetermined session ID, while the XSS vulnerability requires network position to intercept HTTP traffic between the CMS and the plugin server. Combined, these vulnerabilities could allow an attacker to compromise administrative sessions and achieve code execution on vulnerable QuickCMS installations.
Mentioned in this report
Detection guidance
QuickCMS Session Fixation - Pre-Authentication Session Identifier in Request URL
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a PHPSESSID (or similar session identifier) being passed as a URL parameter to a QuickCMS login/authentication endpoint, a pattern consistent with session fixation attacks (CVE-2026-33384) where an attacker forces a known session ID prior to victim authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickCMS Session Fixation via Session ID in Request URL
id: 2be3c28f-2edb-5379-81e5-e0ea0032377e
status: experimental
description: 'Detects HTTP requests to a QuickCMS login or index page where a session
identifier (e.g. PHPSESSID) is supplied as a URL query parameter. This matches the
session fixation technique described in CVE-2026-33384, where an attacker pre-sets
a session ID via a crafted link and social engineers a victim into authenticating
with it, allowing the attacker to hijack the resulting authenticated session.
'
references:
- CVE-2026-33384
author: Vorant
tags:
- attack.t1539
- attack.credential-access
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- PHPSESSID=
- session_id=
- sessid=
login_context:
cs-uri-stem|contains:
- login
- index.php
- admin
condition: selection and login_context
falsepositives:
- Legacy clients or API integrations that intentionally pass session tokens via URL
instead of cookies
- Load balancers or test harnesses that propagate session identifiers in query strings
for automated testing
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-33384
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs