# QuickCMS session fixation and XSS flaws fixed

Published: 2026-05-29 · Severity: medium
Canonical: https://vorant.io/reports/9a24fb3e-1f08-5d35-961f-cdfdaee61cd8/quickcms-session-fixation-and-xss-flaws-fixed

> Two vulnerabilities in QuickCMS allow session hijacking via pre-authentication session fixation and XSS through insecure HTTP plugin fetching; patched in version 6.8.

CERT Polska coordinated the disclosure of two vulnerabilities affecting QuickCMS software. CVE-2026-33384 is a session fixation vulnerability that allows attackers to set a user's session identifier before authentication, with the session ID remaining unchanged after login. This enables an attacker to fix a session ID for a victim and subsequently hijack their authenticated session.

CVE-2026-33386 is a Cross-Site Scripting vulnerability stemming from QuickCMS's insecure HTTP-based plugin-fetching mechanism. An attacker performing a Man-in-the-Middle attack can impersonate the opensolution.org server and serve malicious HTML or JavaScript at the plugin list endpoint. When administrators access the plugin page, the malicious content is automatically fetched, rendered, and executed in their browser context.

Both vulnerabilities were patched in QuickCMS version 6.8, released on 15 May 2026. Deployments running earlier versions remain vulnerable and should upgrade immediately. The vulnerabilities were responsibly disclosed by Jakub Lipiński through CERT Polska's coordinated vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-33384, CVE-2026-33386

## Detection guidance (public sample)

### Session Identifier Set via Query String Prior to Authentication (Session Fixation Pattern)

ATT&CK: T1185

Detects HTTP requests where a session/PHP session identifier is supplied as a URL query parameter to a login or pre-authentication endpoint, matching the session-fixation pattern used to hijack a victim's post-login session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Session ID Supplied via URL Parameter Before Authentication
id: 1cb6e4b3-66e7-519d-a214-374aa211ab95
status: experimental
description: 'QuickCMS prior to 6.8 does not regenerate the session identifier after
  successful login

  (CVE-2026-33384). Attackers can pre-set a session ID via a URL/query parameter and
  send the

  crafted link to a victim; once the victim authenticates, the attacker reuses the
  fixed session

  ID to hijack the authenticated session. This rule looks for session identifier values
  being

  passed as GET parameters to pre-authentication or login pages, which is atypical
  for a

  correctly implemented session handler.

  '
references:
- https://cert.pl
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    c-uri|contains:
    - login
    - auth
  condition: selection
fields:
- c-uri
- cs-host
- src_ip
- c-useragent
falsepositives:
- Legitimate deep-linking implementations that pass session tokens for SSO handoff
- Load balancers or test harnesses that append session identifiers to login URLs for
  health checks
level: medium
tags:
- attack.T1185
- attack.T1557
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-33384

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9a24fb3e-1f08-5d35-961f-cdfdaee61cd8/quickcms-session-fixation-and-xss-flaws-fixed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup