QuickCMS blind SQL injection disclosed
A blind SQL injection flaw (CVE-2025-12465) in OpenSolution QuickCMS 6.8 allows privileged users to conduct injection attacks via the aFilesDelete parameter.
CERT Polska has disclosed a blind SQL injection vulnerability in OpenSolution QuickCMS, assigned CVE-2025-12465. The flaw stems from improper input neutralization in the aFilesDelete parameter, which can be exploited by high-privileged users to conduct blind SQL injection attacks. Version 6.8 has been confirmed vulnerable, though other versions were not tested and may also be affected.
The vulnerability was responsibly reported by security researcher Arkadiusz Marta. CERT Polska coordinated the disclosure process and notified the vendor early, but the vendor did not respond with details about the vulnerability or provide information about the affected version range. Organizations using QuickCMS should assess their exposure and monitor for vendor patches.
While the vulnerability requires high privileges to exploit, SQL injection flaws can enable attackers with existing access to escalate privileges, extract sensitive data, or modify database contents. The lack of vendor engagement and clarity on affected versions complicates remediation efforts for users of the content management system.
Mentioned in this report
Detection guidance
QuickCMS aFilesDelete Parameter SQL Injection Attempt
Detects HTTP requests containing SQL injection payload patterns in the aFilesDelete parameter of QuickCMS, consistent with CVE-2025-12465 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickCMS aFilesDelete Parameter SQL Injection Attempt
id: 5103b9fe-dd0a-5086-88de-0b4815cabea7
status: experimental
logsource:
category: proxy
product: windows
description: 'Detects blind SQL injection payload patterns targeting the aFilesDelete
parameter in OpenSolution QuickCMS (CVE-2025-12465). Attackers with valid high-privileged
accounts can inject SQL boolean/time-based payloads through this parameter to extract
or manipulate database contents.
'
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1190
- attack.t1078
logsource_note: also applicable to category webserver / web application firewall logs
detection:
selection_param:
c-uri|contains: aFilesDelete
selection_sqli:
c-uri|contains:
- ''' OR '
- ''' AND '
- SLEEP(
- BENCHMARK(
- UNION SELECT
- 1=1
- --
- ''';'
- WAITFOR DELAY
condition: selection_param and selection_sqli
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing the endpoint
- Legitimate file deletion requests containing filenames with special characters coincidentally
matching SQL syntax
level: high
author: Vorant
Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint
Detects repeated authenticated requests to the QuickCMS aFilesDelete admin function with varying payload structures, suggesting abuse of a valid high-privileged account to probe or exploit blind SQL injection; investigate volume/timing patterns from a single account or source. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint
id: 10eefcd5-33fe-5938-bdf1-5a3e5975897f
status: experimental
logsource:
category: proxy
product: windows
description: 'Detects authenticated requests to the QuickCMS admin aFilesDelete function
that include atypical query string characters (quotes, comment markers, boolean
operators) often used to probe blind SQL injection. Because blind SQLi requires
many sequential requests to exfiltrate data, analysts should review whether a single
authenticated session issues numerous variations of this request in a short period,
which is a strong indicator of active exploitation rather than normal admin usage.
'
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1078
- attack.t1190
detection:
selection_endpoint:
c-uri|contains: /admin/
selection_param:
c-uri|contains: aFilesDelete
selection_suspicious_chars:
c-uri|contains:
- ''''
- '"'
- /*
- '*/'
- ' OR '
- ' AND '
condition: selection_endpoint and selection_param and selection_suspicious_chars
falsepositives:
- Legitimate administrators deleting files with names containing apostrophes or special
characters
- Internal QA/testing of the CMS admin panel
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-12465
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free