Full Report
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-63301 to CVE-2026-63303) found in OpenSolution Quick.CMS software.
Analysis Summary
# Vulnerability: Multiple Flaws in OpenSolution Quick.CMS
## CVE Details
- **CVE ID:** CVE-2026-63301, CVE-2026-63302, CVE-2026-63303
- **CVSS Score:** Not explicitly provided in the source (Estimate: Medium to High)
- **CWE:**
- CWE-602: Client-Side Enforcement of Server-Side Security
- CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (LFI)
- CWE-23: Relative Path Traversal
## Affected Systems
- **Products:** OpenSolution Quick.CMS
- **Versions:** All versions through 6.8.0
- **Configurations:** Default installations; specifically impacts the `admin.php` endpoint and API handlers.
## Vulnerability Description
Three distinct security flaws were identified in the Quick.CMS software:
1. **CVE-2026-63301 (Insecure API Design):** The administrative API fails to perform server-side checks when deleting languages. While the UI hides the "delete" button for the primary language, the API still processes direct requests to delete it. Removing the primary language causes a site-wide Denial of Service (DoS).
2. **CVE-2026-63302 (Local File Inclusion):** The `admin.php` endpoint incorrectly sanitizes the `p` parameter, allowing an authenticated user to include arbitrary files from the application's directory, leading to sensitive information disclosure.
3. **CVE-2026-63303 (Path Traversal):** The server fails to normalize dot-dot-slash (`../`) sequences in URI paths. This allows authenticated attackers to traverse outside the webroot and read files in sibling directories.
## Exploitation
- **Status:** PoC described in report; no confirmed "in the wild" exploitation reported.
- **Complexity:** Low (CVE-2026-63301 can be chained with CSRF for easier exploitation).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Ability to read sensitive configuration files and sibling directory contents).
- **Integrity:** Medium (Ability to delete critical system configurations/languages).
- **Availability:** High (Deletion of primary language results in a complete application DoS).
## Remediation
### Patches
- **No patches available.** The vendor (OpenSolution) has assessed these vulnerabilities and determined that fixes are not necessary, citing a "very low" likelihood of exploitation.
### Workarounds
- **Strict Access Control:** Restrict access to the `admin.php` and administrative directories to trusted IP addresses only.
- **CSRF Protection:** Ensure robust CSRF protections are in place to prevent the chaining of CVE-2026-63301.
- **File System Permissions:** Tighten OS-level file permissions to ensure the web server user cannot read files outside the necessary web directories.
## Detection
- **Indicators of Compromise:**
- Presence of `../` sequences in web server access logs targeting `admin.php`.
- Unexpected deletion of the primary language configuration.
- **Detection methods:** Monitor for unusual parameters passed to the `p` variable in administrative GET/POST requests.
## References
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/vulnerabilities-in-quick-cms-software/
- **CVE-2026-63301:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-63301
- **CVE-2026-63302:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-63302
- **CVE-2026-63303:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-63303