QuickCMS blind SQL injection disclosed
A blind SQL injection flaw (CVE-2025-12465) in OpenSolution QuickCMS 6.8 allows privileged users to conduct injection attacks via the aFilesDelete parameter.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has disclosed a blind SQL injection vulnerability in OpenSolution QuickCMS, assigned CVE-2025-12465. The flaw stems from improper input neutralization in the aFilesDelete parameter, which can be exploited by high-privileged users to conduct blind SQL injection attacks. Version 6.8 has been confirmed vulnerable, though other versions were not tested and may also be affected.
The vulnerability was responsibly reported by security researcher Arkadiusz Marta. CERT Polska coordinated the disclosure process and notified the vendor early, but the vendor did not respond with details about the vulnerability or provide information about the affected version range. Organizations using QuickCMS should assess their exposure and monitor for vendor patches.
While the vulnerability requires high privileges to exploit, SQL injection flaws can enable attackers with existing access to escalate privileges, extract sensitive data, or modify database contents. The lack of vendor engagement and clarity on affected versions complicates remediation efforts for users of the content management system.
Mentioned in this report
Detection guidance
QuickCMS aFilesDelete Parameter SQL Injection Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing SQL injection payload patterns in the aFilesDelete parameter of QuickCMS, consistent with CVE-2025-12465 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickCMS aFilesDelete Parameter SQL Injection Attempt
id: 5103b9fe-dd0a-5086-88de-0b4815cabea7
status: experimental
logsource:
category: proxy
description: 'Detects blind SQL injection payload patterns targeting the aFilesDelete
parameter in OpenSolution QuickCMS (CVE-2025-12465). Attackers with valid high-privileged
accounts can inject SQL boolean/time-based payloads through this parameter to extract
or manipulate database contents.
'
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1190
- attack.t1078
logsource_note: also applicable to category webserver / web application firewall logs
detection:
selection_param:
c-uri|contains: aFilesDelete
selection_sqli:
c-uri|contains:
- ''' OR '
- ''' AND '
- SLEEP(
- BENCHMARK(
- UNION SELECT
- 1=1
- --
- ''';'
- WAITFOR DELAY
condition: selection_param and selection_sqli
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing the endpoint
- Legitimate file deletion requests containing filenames with special characters coincidentally
matching SQL syntax
level: high
author: Vorant
Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects repeated authenticated requests to the QuickCMS aFilesDelete admin function with varying payload structures, suggesting abuse of a valid high-privileged account to probe or exploit blind SQL injection; investigate volume/timing patterns from a single account or source. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint
id: 10eefcd5-33fe-5938-bdf1-5a3e5975897f
status: experimental
logsource:
category: proxy
description: 'Detects authenticated requests to the QuickCMS admin aFilesDelete function
that include atypical query string characters (quotes, comment markers, boolean
operators) often used to probe blind SQL injection. Because blind SQLi requires
many sequential requests to exfiltrate data, analysts should review whether a single
authenticated session issues numerous variations of this request in a short period,
which is a strong indicator of active exploitation rather than normal admin usage.
'
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1078
- attack.t1190
detection:
selection_endpoint:
c-uri|contains: /admin/
selection_param:
c-uri|contains: aFilesDelete
selection_suspicious_chars:
c-uri|contains:
- ''''
- '"'
- /*
- '*/'
- ' OR '
- ' AND '
condition: selection_endpoint and selection_param and selection_suspicious_chars
falsepositives:
- Legitimate administrators deleting files with names containing apostrophes or special
characters
- Internal QA/testing of the CMS admin panel
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-12465
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs