QuickCMS version 6.8 and earlier contains session fixation and XSS vulnerabilities…
QuickCMS version 6.8 and earlier contains session fixation and XSS vulnerabilities allowing session hijacking and code execution via MITM attacks.
CERT Polska coordinated the disclosure of two vulnerabilities in QuickCMS software reported by security researcher Jakub Lipiński. CVE-2026-33384 is a session fixation vulnerability where an attacker can set a session identifier before authentication that persists after login, enabling session hijacking attacks. CVE-2026-33386 is a cross-site scripting vulnerability exploitable through QuickCMS's insecure HTTP-based plugin fetching mechanism, allowing attackers to conduct man-in-the-middle attacks by impersonating the opensolution.org server and injecting malicious HTML or JavaScript that executes when administrators access the plugin page.
Both vulnerabilities were patched in QuickCMS version 6.8 released on May 15, 2026. Organizations running unpatched versions remain vulnerable to these attacks. The session fixation issue requires an attacker to social engineer a victim into using a predetermined session ID, while the XSS vulnerability requires network position to intercept HTTP traffic between the CMS and the plugin server. Combined, these vulnerabilities could allow an attacker to compromise administrative sessions and achieve code execution on vulnerable QuickCMS installations.
Mentioned in this report
Detection guidance
QuickCMS Session Fixation - Pre-Authentication Session Identifier in Request URL
Detects a PHPSESSID (or similar session identifier) being passed as a URL parameter to a QuickCMS login/authentication endpoint, a pattern consistent with session fixation attacks (CVE-2026-33384) where an attacker forces a known session ID prior to victim authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickCMS Session Fixation via Session ID in Request URL
id: 2be3c28f-2edb-5379-81e5-e0ea0032377e
status: experimental
description: 'Detects HTTP requests to a QuickCMS login or index page where a session
identifier (e.g. PHPSESSID) is supplied as a URL query parameter. This matches the
session fixation technique described in CVE-2026-33384, where an attacker pre-sets
a session ID via a crafted link and social engineers a victim into authenticating
with it, allowing the attacker to hijack the resulting authenticated session.
'
references:
- CVE-2026-33384
author: Vorant
tags:
- attack.t1539
- attack.credential-access
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- PHPSESSID=
- session_id=
- sessid=
login_context:
cs-uri-stem|contains:
- login
- index.php
- admin
condition: selection and login_context
falsepositives:
- Legacy clients or API integrations that intentionally pass session tokens via URL
instead of cookies
- Load balancers or test harnesses that propagate session identifiers in query strings
for automated testing
level: medium
Cleartext HTTP Plugin Fetch to opensolution.org Enabling AiTM Injection
Detects outbound plugin-update HTTP (non-TLS) connections from a QuickCMS host to the opensolution.org plugin server, the insecure fetch mechanism abused in CVE-2026-33386 to allow a network-positioned attacker to impersonate the server and inject malicious script content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickCMS Plugin Fetch Over Cleartext HTTP to opensolution.org
id: 2fdef4b5-43e0-5b3d-b23b-ccfaca804286
status: experimental
description: 'Detects the QuickCMS plugin update/fetch mechanism communicating with
the opensolution.org plugin server over unencrypted HTTP (port 80) rather than HTTPS.
This cleartext channel is the precondition exploited in CVE-2026-33386, allowing
a network-positioned attacker to perform an adversary-in-the-middle attack, impersonate
the plugin server, and inject malicious HTML/JavaScript that executes in the admin
plugin page context.
'
references:
- CVE-2026-33386
author: Vorant
tags:
- attack.t1557
- attack.collection
logsource:
category: proxy
detection:
selection:
dest_hostname|contains: opensolution.org
dest_port: 80
c-uri|contains:
- plugin
- plugins
filter_tls:
protocol: https
condition: selection and not filter_tls
falsepositives:
- Legitimate but unpatched QuickCMS installations performing normal plugin update
checks over HTTP (indicates exposure, not necessarily active compromise)
- Proxy re-writing/downgrading HTTPS to HTTP for internal inspection appliances
level: medium
Suspicious Script Content Injected in QuickCMS Plugin Server Response
Detects HTTP responses from the opensolution.org plugin endpoint containing inline script or event-handler markup, consistent with an AiTM attacker impersonating the plugin server to deliver a drive-by XSS payload that executes when an administrator loads the plugin management page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Injection in HTTP Response from QuickCMS Plugin Server
id: d54ecc73-f145-5fbf-8fb5-ac2ac3bd412b
status: experimental
description: 'Detects HTTP response bodies from requests to the opensolution.org plugin
fetch endpoint that contain inline script tags or on-event JavaScript handlers.
This reflects the drive-by compromise pattern in CVE-2026-33386, where a man-in-the-middle
attacker impersonates the legitimate plugin server and injects malicious HTML/JS
that executes in the QuickCMS administrator''s browser session.
'
references:
- CVE-2026-33386
author: Vorant
tags:
- attack.t1189
- attack.initial-access
logsource:
category: proxy
detection:
selection:
dest_hostname|contains: opensolution.org
c-uri|contains: plugin
response_indicator:
r-response-body|contains:
- <script
- onerror=
- onload=
- 'javascript:'
condition: selection and response_indicator
falsepositives:
- Plugin server legitimately embedding inline analytics or widget scripts in its update
page responses
- Proxy/security appliance response rewriting that inserts benign script snippets
for content filtering
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-33384
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free