OpenSolution QuickCMS Session Fixation Vulnerability Allowing Session Hijacking

A session fixation vulnerability has been identified in OpenSolution QuickCMS versions prior to 6.8. This issue allows an attacker to set a user's session identifier before authentication, with the session ID remaining unchanged after authentication. As a result, an attacker can hijack an authenticated session by fixing a session ID for a victim.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can take over an authenticated user's session.

Remediation

Users can upgrade to QuickCMS version 6.8, released on May 15, 2026, to address this vulnerability.