Blind SQL injection vulnerability CVE-2025-12465 in OpenSolution QuickCMS 6.8 allows…
Blind SQL injection vulnerability CVE-2025-12465 in OpenSolution QuickCMS 6.8 allows privileged users to execute SQL injection attacks via aFilesDelete parameter.
CERT Polska disclosed a blind SQL injection vulnerability in OpenSolution QuickCMS content management system. The vulnerability, tracked as CVE-2025-12465, stems from improper input neutralization in the aFilesDelete parameter and requires high-privileged user access to exploit. Version 6.8 has been confirmed vulnerable through testing, though the full scope of affected versions remains unclear as the vendor did not provide version range information.
The vulnerability was discovered by security researcher Arkadiusz Marta and reported responsibly to CERT Polska. Despite early notification, the vendor did not respond with details about the vulnerability or clarify which product versions are affected. Organizations running QuickCMS should assume all versions may be vulnerable until vendor guidance is published.
While the vulnerability requires elevated privileges to exploit, blind SQL injection can lead to unauthorized database access, data exfiltration, and potential system compromise. The severity is elevated by the lack of vendor response and uncertainty around affected versions, though the high privilege requirement limits the attack surface to scenarios involving compromised administrative accounts or malicious insiders.
Mentioned in this report
Detection guidance
Possible SQL Injection Attempt via aFilesDelete Parameter in QuickCMS
Detects HTTP requests containing SQL injection payloads in the aFilesDelete parameter of OpenSolution QuickCMS, consistent with CVE-2025-12465 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection Attempt via aFilesDelete Parameter in QuickCMS
id: e856a85c-8a5b-546d-89ee-95cf025f0309
status: experimental
description: 'Detects web requests targeting the aFilesDelete parameter in OpenSolution
QuickCMS containing
common SQL injection syntax (quotes, UNION SELECT, boolean or time-based blind SQLi
indicators),
consistent with exploitation of CVE-2025-12465.
'
references:
- CERT Polska advisory on CVE-2025-12465
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains: aFilesDelete
selection_sqli:
cs-uri-query|contains:
- ''''
- --
- UNION SELECT
- union select
- ' OR 1=1'
- ' or 1=1'
- SLEEP(
- sleep(
- BENCHMARK(
- benchmark(
- AND SLEEP
- and sleep
condition: selection_param and selection_sqli
falsepositives:
- Legitimate automated vulnerability scanning or penetration testing against the CMS
- Developers testing file deletion functionality with unusual characters in parameters
level: high
Blind Time-Based SQL Injection Indicators in Web Request Parameters
Detects HTTP requests with time-based blind SQL injection functions (SLEEP, BENCHMARK, WAITFOR DELAY) commonly used to exploit blind SQLi vulnerabilities such as CVE-2025-12465. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Blind Time-Based SQL Injection Indicators in Web Request Parameters
id: 65dfcbb1-2695-5adf-beea-c7def0d5db8d
status: experimental
description: 'Detects HTTP request query strings or POST bodies containing time-based
blind SQL injection
test functions (SLEEP, BENCHMARK, WAITFOR DELAY, pg_sleep) which are typically used
to confirm
and exploit blind SQL injection vulnerabilities like CVE-2025-12465 in QuickCMS.
'
references:
- CERT Polska advisory on CVE-2025-12465
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- SLEEP(
- sleep(
- BENCHMARK(
- benchmark(
- WAITFOR DELAY
- waitfor delay
- pg_sleep(
- PG_SLEEP(
condition: selection
falsepositives:
- Authorized penetration testing or bug bounty scanning tools probing for blind SQL
injection
- Automated web application security scanners configured to test time-based SQLi payloads
level: medium
Suspicious Administrative Access Followed by Bulk Data Export from CMS Database
Detects a high volume of file/data export or download requests from an authenticated administrative session shortly after suspicious parameter manipulation, indicating potential data exfiltration following SQL injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Bulk Data Export Requests from CMS Admin Panel
id: 7221ea4f-40f6-5f57-bf15-2738658acb49
status: experimental
description: 'Detects repeated export, dump, or download-related requests issued from
the same authenticated
administrative session on a CMS platform, which may indicate data exfiltration from
information
repositories following exploitation of an SQL injection vulnerability such as CVE-2025-12465.
This rule flags individual suspicious export requests; correlation across multiple
requests within
a short window should be reviewed manually or via SIEM aggregation outside of this
rule condition.
'
references:
- CERT Polska advisory on CVE-2025-12465
author: Vorant
tags:
- attack.t1213
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- export
- dump
- download
- backup
cs-uri-stem|contains: admin
condition: selection
falsepositives:
- Legitimate administrators performing scheduled database backups or content exports
- CMS built-in export features used for routine site migration
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-12465
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free