# QuickCMS version 6.8 and earlier contains session fixation and XSS vulnerabilities… Published: 2026-05-29 · Severity: high Canonical: https://vorant.io/reports/92a74fd0-934b-4034-8de1-34e513766765/quickcms-version-6-8-and-earlier-contains-session-fixation-and-xss > QuickCMS version 6.8 and earlier contains session fixation and XSS vulnerabilities allowing session hijacking and code execution via MITM attacks. CERT Polska coordinated the disclosure of two vulnerabilities in QuickCMS software reported by security researcher Jakub Lipiński. CVE-2026-33384 is a session fixation vulnerability where an attacker can set a session identifier before authentication that persists after login, enabling session hijacking attacks. CVE-2026-33386 is a cross-site scripting vulnerability exploitable through QuickCMS's insecure HTTP-based plugin fetching mechanism, allowing attackers to conduct man-in-the-middle attacks by impersonating the opensolution.org server and injecting malicious HTML or JavaScript that executes when administrators access the plugin page. Both vulnerabilities were patched in QuickCMS version 6.8 released on May 15, 2026. Organizations running unpatched versions remain vulnerable to these attacks. The session fixation issue requires an attacker to social engineer a victim into using a predetermined session ID, while the XSS vulnerability requires network position to intercept HTTP traffic between the CMS and the plugin server. Combined, these vulnerabilities could allow an attacker to compromise administrative sessions and achieve code execution on vulnerable QuickCMS installations. ## Mentioned in this report - Vulnerabilities: CVE-2026-33384, CVE-2026-33386 ## Detection guidance (public sample) ### QuickCMS Session Fixation - Pre-Authentication Session Identifier in Request URL ATT&CK: T1539 Detects a PHPSESSID (or similar session identifier) being passed as a URL parameter to a QuickCMS login/authentication endpoint, a pattern consistent with session fixation attacks (CVE-2026-33384) where an attacker forces a known session ID prior to victim authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: QuickCMS Session Fixation via Session ID in Request URL id: 2be3c28f-2edb-5379-81e5-e0ea0032377e status: experimental description: 'Detects HTTP requests to a QuickCMS login or index page where a session identifier (e.g. PHPSESSID) is supplied as a URL query parameter. This matches the session fixation technique described in CVE-2026-33384, where an attacker pre-sets a session ID via a crafted link and social engineers a victim into authenticating with it, allowing the attacker to hijack the resulting authenticated session. ' references: - CVE-2026-33384 author: Vorant tags: - attack.t1539 - attack.credential-access logsource: category: webserver detection: selection: cs-uri-query|contains: - PHPSESSID= - session_id= - sessid= login_context: cs-uri-stem|contains: - login - index.php - admin condition: selection and login_context falsepositives: - Legacy clients or API integrations that intentionally pass session tokens via URL instead of cookies - Load balancers or test harnesses that propagate session identifiers in query strings for automated testing level: medium ``` ### Cleartext HTTP Plugin Fetch to opensolution.org Enabling AiTM Injection ATT&CK: T1557 Detects outbound plugin-update HTTP (non-TLS) connections from a QuickCMS host to the opensolution.org plugin server, the insecure fetch mechanism abused in CVE-2026-33386 to allow a network-positioned attacker to impersonate the server and inject malicious script content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: QuickCMS Plugin Fetch Over Cleartext HTTP to opensolution.org id: 2fdef4b5-43e0-5b3d-b23b-ccfaca804286 status: experimental description: 'Detects the QuickCMS plugin update/fetch mechanism communicating with the opensolution.org plugin server over unencrypted HTTP (port 80) rather than HTTPS. This cleartext channel is the precondition exploited in CVE-2026-33386, allowing a network-positioned attacker to perform an adversary-in-the-middle attack, impersonate the plugin server, and inject malicious HTML/JavaScript that executes in the admin plugin page context. ' references: - CVE-2026-33386 author: Vorant tags: - attack.t1557 - attack.collection logsource: category: proxy detection: selection: dest_hostname|contains: opensolution.org dest_port: 80 c-uri|contains: - plugin - plugins filter_tls: protocol: https condition: selection and not filter_tls falsepositives: - Legitimate but unpatched QuickCMS installations performing normal plugin update checks over HTTP (indicates exposure, not necessarily active compromise) - Proxy re-writing/downgrading HTTPS to HTTP for internal inspection appliances level: medium ``` ### Suspicious Script Content Injected in QuickCMS Plugin Server Response ATT&CK: T1189 Detects HTTP responses from the opensolution.org plugin endpoint containing inline script or event-handler markup, consistent with an AiTM attacker impersonating the plugin server to deliver a drive-by XSS payload that executes when an administrator loads the plugin management page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Script Injection in HTTP Response from QuickCMS Plugin Server id: d54ecc73-f145-5fbf-8fb5-ac2ac3bd412b status: experimental description: 'Detects HTTP response bodies from requests to the opensolution.org plugin fetch endpoint that contain inline script tags or on-event JavaScript handlers. This reflects the drive-by compromise pattern in CVE-2026-33386, where a man-in-the-middle attacker impersonates the legitimate plugin server and injects malicious HTML/JS that executes in the QuickCMS administrator''s browser session. ' references: - CVE-2026-33386 author: Vorant tags: - attack.t1189 - attack.initial-access logsource: category: proxy detection: selection: dest_hostname|contains: opensolution.org c-uri|contains: plugin response_indicator: r-response-body|contains: -