Quick.Cart XSS and RCE flaws disclosed
OpenSolution Quick.Cart version 6.7 contains a reflected XSS flaw and a file inclusion vulnerability enabling remote code execution by privileged users.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities in OpenSolution Quick.Cart e-commerce software following coordinated disclosure efforts. CVE-2025-67683 is a reflected cross-site scripting vulnerability in the sSort parameter that allows attackers to execute arbitrary JavaScript in victims' browsers through crafted URLs. CVE-2025-67684 is a more severe local file inclusion and path traversal issue in the theme selection mechanism that permits privileged users to upload files with arbitrary content while only validating extensions, leading to remote code execution on the server.
Version 6.7 was tested and confirmed vulnerable; the vendor was notified but did not respond with details about affected version ranges or patching timelines. Other versions may also be vulnerable but were not tested. The vulnerabilities were responsibly reported by researcher Arkadiusz Marta through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Quick.Cart Reflected XSS Attempt via sSort Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing script or event-handler payloads in the sSort parameter, consistent with CVE-2025-67683 reflected XSS exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.Cart Reflected XSS Attempt via sSort Parameter
id: af829f6b-3f23-5f53-a819-7a1f91084fad
status: experimental
description: Detects reflected XSS exploitation attempts against the sSort parameter
in Quick.Cart, where crafted URLs inject script or event-handler payloads reflected
back into browser responses (CVE-2025-67683).
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: sSort=
payload:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
condition: selection and payload
falsepositives:
- Security scanners or automated vulnerability assessment tools testing the sSort
parameter
- Legitimate URLs containing the substring sSort with encoded special characters used
for non-malicious sorting features
level: medium
tags:
- attack.t1189
- attack.initial-access
author: Vorant
Quick.Cart Theme File Upload with Suspicious Server-Side Extension
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects requests to the Quick.Cart theme selection/upload mechanism containing filenames with server-executable extensions, indicative of CVE-2025-67684 LFI/path traversal to RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.Cart Theme Upload with Executable Extension
id: 69de77e5-7dab-5c22-9bf6-18c9ec9ec81c
status: experimental
description: Detects HTTP requests to Quick.Cart's theme selection/upload functionality
where the uploaded filename or path parameter carries a server-executable extension
(e.g. .php) rather than an expected theme/image extension, consistent with CVE-2025-67684
arbitrary file upload leading to remote code execution.
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- theme=
- themes/
suspicious_ext:
cs-uri-query|contains:
- .php
- .phtml
- .php5
- .pht
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
condition: selection and (suspicious_ext or traversal)
falsepositives:
- Legitimate theme administration workflows referencing theme directory paths that
happen to contain the substring php in filenames
- Vulnerability scanners actively testing the endpoint
level: high
tags:
- attack.t1189
- attack.initial-access
author: Vorant
Unix Shell Spawned from Web Server Process (Possible Quick.Cart RCE Post-Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell process spawned directly from a web server or PHP-FPM process, consistent with post-exploitation shell execution after a successful file-upload RCE such as CVE-2025-67684. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Web Server Process
id: 57fba49c-84b2-50d1-afee-acc0b34c5430
status: experimental
description: Detects execution of /bin/sh, /bin/bash, or similar shells with a parent
process of a web server or PHP-FPM binary, which can indicate a web shell dropped
through an arbitrary file upload vulnerability (e.g. Quick.Cart CVE-2025-67684)
being used to execute OS commands.
references:
- CERT Polska Quick.Cart disclosure
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /php-fpm
- /nginx
Image|endswith:
- /sh
- /bash
- /dash
filter_healthcheck:
CommandLine|contains:
- apachectl
- logrotate
condition: selection and not filter_healthcheck
falsepositives:
- Legitimate server maintenance scripts or health-check cron jobs invoked through
the web server's process tree
- CGI scripts intentionally invoking shell utilities as part of normal application
logic
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-67683
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs