OpenSolution QuickCMS Stored Cross-Site Scripting Vulnerability in Language Editor

A stored cross-site scripting vulnerability has been identified in OpenSolution QuickCMS version 6.8. This issue arises in the language editor feature, where an administrator can inject arbitrary HTML and JavaScript. The injected content is executed on every page of the website. By default, administrators cannot add JavaScript, making this vulnerability particularly concerning. While version 6.8 has been confirmed vulnerable, other versions may also be affected.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.