QuickCMS session fixation and XSS flaws fixed
Two vulnerabilities in QuickCMS allow session hijacking via pre-authentication session fixation and XSS through insecure HTTP plugin fetching; patched in version 6.8.
CERT Polska coordinated the disclosure of two vulnerabilities affecting QuickCMS software. CVE-2026-33384 is a session fixation vulnerability that allows attackers to set a user's session identifier before authentication, with the session ID remaining unchanged after login. This enables an attacker to fix a session ID for a victim and subsequently hijack their authenticated session.
CVE-2026-33386 is a Cross-Site Scripting vulnerability stemming from QuickCMS's insecure HTTP-based plugin-fetching mechanism. An attacker performing a Man-in-the-Middle attack can impersonate the opensolution.org server and serve malicious HTML or JavaScript at the plugin list endpoint. When administrators access the plugin page, the malicious content is automatically fetched, rendered, and executed in their browser context.
Both vulnerabilities were patched in QuickCMS version 6.8, released on 15 May 2026. Deployments running earlier versions remain vulnerable and should upgrade immediately. The vulnerabilities were responsibly disclosed by Jakub Lipiński through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Session Identifier Set via Query String Prior to Authentication (Session Fixation Pattern)
Detects HTTP requests where a session/PHP session identifier is supplied as a URL query parameter to a login or pre-authentication endpoint, matching the session-fixation pattern used to hijack a victim's post-login session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Session ID Supplied via URL Parameter Before Authentication
id: 1cb6e4b3-66e7-519d-a214-374aa211ab95
status: experimental
description: 'QuickCMS prior to 6.8 does not regenerate the session identifier after
successful login
(CVE-2026-33384). Attackers can pre-set a session ID via a URL/query parameter and
send the
crafted link to a victim; once the victim authenticates, the attacker reuses the
fixed session
ID to hijack the authenticated session. This rule looks for session identifier values
being
passed as GET parameters to pre-authentication or login pages, which is atypical
for a
correctly implemented session handler.
'
references:
- https://cert.pl
logsource:
category: webserver
detection:
selection:
cs-method: GET
c-uri|contains:
- login
- auth
condition: selection
fields:
- c-uri
- cs-host
- src_ip
- c-useragent
falsepositives:
- Legitimate deep-linking implementations that pass session tokens for SSO handoff
- Load balancers or test harnesses that append session identifiers to login URLs for
health checks
level: medium
tags:
- attack.T1185
- attack.T1557
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-33384
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free