PT-2025-50760 · Quick.Cms · Quick.Cms

Diyar ./H4X.Forensics · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58308

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quick.CMS version 6.7

Description The software contains a SQL injection flaw that allows unauthenticated attackers to bypass login authentication. Attackers can manipulate the login form with SQL payloads, such as ' or '1'='1, to gain unauthorized administrative access. The vulnerable component is the login form. The API endpoint involved is the login form. The vulnerable parameter is the username field.

Recommendations Apply a fix to sanitize user input in the login form to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-58308

Affected Products

Quick.Cms

References · 9

• 🔥 https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip · Exploit
• 🔥 https://exploit-db.com/exploits/51910 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58308 · Security Note
• https://t.me/CVEtracker/39538 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999283622033985751 · Twitter Post
• https://vulncheck.com/advisories/quickcms-sql-injection-authentication-bypass-via-admin-login · Note
• https://opensolution.org · Note
• https://twitter.com/0dayPublishing/status/1999236618582933723 · Twitter Post