Description
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://opensolution.org/cms-system-quick-cms.html ↗
- https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html ↗
- https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/ ↗
- http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html ↗