Quick.Cart XSS and RCE flaws disclosed
OpenSolution Quick.Cart version 6.7 contains a reflected XSS flaw and a file inclusion vulnerability enabling remote code execution by privileged users.
CERT Polska disclosed two vulnerabilities in OpenSolution Quick.Cart e-commerce software following coordinated disclosure efforts. CVE-2025-67683 is a reflected cross-site scripting vulnerability in the sSort parameter that allows attackers to execute arbitrary JavaScript in victims' browsers through crafted URLs. CVE-2025-67684 is a more severe local file inclusion and path traversal issue in the theme selection mechanism that permits privileged users to upload files with arbitrary content while only validating extensions, leading to remote code execution on the server.
Version 6.7 was tested and confirmed vulnerable; the vendor was notified but did not respond with details about affected version ranges or patching timelines. Other versions may also be vulnerable but were not tested. The vulnerabilities were responsibly reported by researcher Arkadiusz Marta through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Quick.Cart Reflected XSS Attempt via sSort Parameter
Detects HTTP requests containing script or event-handler payloads in the sSort parameter, consistent with CVE-2025-67683 reflected XSS exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.Cart Reflected XSS Attempt via sSort Parameter
id: af829f6b-3f23-5f53-a819-7a1f91084fad
status: experimental
description: Detects reflected XSS exploitation attempts against the sSort parameter
in Quick.Cart, where crafted URLs inject script or event-handler payloads reflected
back into browser responses (CVE-2025-67683).
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: sSort=
payload:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
condition: selection and payload
falsepositives:
- Security scanners or automated vulnerability assessment tools testing the sSort
parameter
- Legitimate URLs containing the substring sSort with encoded special characters used
for non-malicious sorting features
level: medium
tags:
- attack.t1189
- attack.initial_access
author: Vorant
Quick.Cart Theme File Upload with Suspicious Server-Side Extension
Detects requests to the Quick.Cart theme selection/upload mechanism containing filenames with server-executable extensions, indicative of CVE-2025-67684 LFI/path traversal to RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.Cart Theme Upload with Executable Extension
id: 69de77e5-7dab-5c22-9bf6-18c9ec9ec81c
status: experimental
description: Detects HTTP requests to Quick.Cart's theme selection/upload functionality
where the uploaded filename or path parameter carries a server-executable extension
(e.g. .php) rather than an expected theme/image extension, consistent with CVE-2025-67684
arbitrary file upload leading to remote code execution.
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- theme=
- themes/
suspicious_ext:
cs-uri-query|contains:
- .php
- .phtml
- .php5
- .pht
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
condition: selection and (suspicious_ext or traversal)
falsepositives:
- Legitimate theme administration workflows referencing theme directory paths that
happen to contain the substring php in filenames
- Vulnerability scanners actively testing the endpoint
level: high
tags:
- attack.t1189
- attack.initial_access
author: Vorant
Unix Shell Spawned from Web Server Process (Possible Quick.Cart RCE Post-Exploitation)
Detects a shell process spawned directly from a web server or PHP-FPM process, consistent with post-exploitation shell execution after a successful file-upload RCE such as CVE-2025-67684. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Web Server Process
id: 57fba49c-84b2-50d1-afee-acc0b34c5430
status: experimental
description: Detects execution of /bin/sh, /bin/bash, or similar shells with a parent
process of a web server or PHP-FPM binary, which can indicate a web shell dropped
through an arbitrary file upload vulnerability (e.g. Quick.Cart CVE-2025-67684)
being used to execute OS commands.
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /php-fpm
- /nginx
Image|endswith:
- /sh
- /bash
- /dash
filter_healthcheck:
CommandLine|contains:
- apachectl
- logrotate
condition: selection and not filter_healthcheck
falsepositives:
- Legitimate server maintenance scripts or health-check cron jobs invoked through
the web server's process tree
- CGI scripts intentionally invoking shell utilities as part of normal application
logic
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-67683
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free