# QuickCMS blind SQL injection disclosed

Published: 2025-12-02 · Severity: medium
Canonical: https://vorant.io/reports/f06763fe-33cc-59a7-b17e-65c32a55ae30/quickcms-blind-sql-injection-disclosed

> A blind SQL injection flaw (CVE-2025-12465) in OpenSolution QuickCMS 6.8 allows privileged users to conduct injection attacks via the aFilesDelete parameter.

CERT Polska has disclosed a blind SQL injection vulnerability in OpenSolution QuickCMS, assigned CVE-2025-12465. The flaw stems from improper input neutralization in the aFilesDelete parameter, which can be exploited by high-privileged users to conduct blind SQL injection attacks. Version 6.8 has been confirmed vulnerable, though other versions were not tested and may also be affected.

The vulnerability was responsibly reported by security researcher Arkadiusz Marta. CERT Polska coordinated the disclosure process and notified the vendor early, but the vendor did not respond with details about the vulnerability or provide information about the affected version range. Organizations using QuickCMS should assess their exposure and monitor for vendor patches.

While the vulnerability requires high privileges to exploit, SQL injection flaws can enable attackers with existing access to escalate privileges, extract sensitive data, or modify database contents. The lack of vendor engagement and clarity on affected versions complicates remediation efforts for users of the content management system.

## Mentioned in this report

- Vulnerabilities: CVE-2025-12465

## Detection guidance (public sample)

### QuickCMS aFilesDelete Parameter SQL Injection Attempt

ATT&CK: T1190

Detects HTTP requests containing SQL injection payload patterns in the aFilesDelete parameter of QuickCMS, consistent with CVE-2025-12465 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: QuickCMS aFilesDelete Parameter SQL Injection Attempt
id: 5103b9fe-dd0a-5086-88de-0b4815cabea7
status: experimental
logsource:
  category: proxy
  product: windows
description: 'Detects blind SQL injection payload patterns targeting the aFilesDelete
  parameter in OpenSolution QuickCMS (CVE-2025-12465). Attackers with valid high-privileged
  accounts can inject SQL boolean/time-based payloads through this parameter to extract
  or manipulate database contents.

  '
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1190
- attack.t1078
logsource_note: also applicable to category webserver / web application firewall logs
detection:
  selection_param:
    c-uri|contains: aFilesDelete
  selection_sqli:
    c-uri|contains:
    - ''' OR '
    - ''' AND '
    - SLEEP(
    - BENCHMARK(
    - UNION SELECT
    - 1=1
    - --
    - ''';'
    - WAITFOR DELAY
  condition: selection_param and selection_sqli
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing the endpoint
- Legitimate file deletion requests containing filenames with special characters coincidentally
  matching SQL syntax
level: high
author: Vorant
```

### Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint

ATT&CK: T1078

Detects repeated authenticated requests to the QuickCMS aFilesDelete admin function with varying payload structures, suggesting abuse of a valid high-privileged account to probe or exploit blind SQL injection; investigate volume/timing patterns from a single account or source. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Repeated Anomalous Requests to QuickCMS Admin File Deletion Endpoint
id: 10eefcd5-33fe-5938-bdf1-5a3e5975897f
status: experimental
logsource:
  category: proxy
  product: windows
description: 'Detects authenticated requests to the QuickCMS admin aFilesDelete function
  that include atypical query string characters (quotes, comment markers, boolean
  operators) often used to probe blind SQL injection. Because blind SQLi requires
  many sequential requests to exfiltrate data, analysts should review whether a single
  authenticated session issues numerous variations of this request in a short period,
  which is a strong indicator of active exploitation rather than normal admin usage.

  '
references:
- CERT Polska CVE-2025-12465 advisory
tags:
- attack.t1078
- attack.t1190
detection:
  selection_endpoint:
    c-uri|contains: /admin/
  selection_param:
    c-uri|contains: aFilesDelete
  selection_suspicious_chars:
    c-uri|contains:
    - ''''
    - '"'
    - /*
    - '*/'
    - ' OR '
    - ' AND '
  condition: selection_endpoint and selection_param and selection_suspicious_chars
falsepositives:
- Legitimate administrators deleting files with names containing apostrophes or special
  characters
- Internal QA/testing of the CMS admin panel
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-12465

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f06763fe-33cc-59a7-b17e-65c32a55ae30/quickcms-blind-sql-injection-disclosed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup