Sending Password in GET Request_CVE-2025-54542

6.9 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Basic Information

ID CVE-2025-54542

Source CERT-PL

Published Aug 28, 2025 at 10:12

Modified Aug 28, 2025 at 10:13

Affected Product

Vendor OpenSolution

Product QuickCMS

Version 6.8

Affected Versions OpenSolution QuickCMS 6.8

CWE Classification

CWE-598

References

{
    "lastseen": "",
    "description": "QuickCMS sends password and login via GET Request. This allows a\u00a0local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
    "published": "2025-08-28T10:12:38.118Z",
    "modified": "2025-08-28T10:13:32.629Z",
    "type": "cve",
    "title": "Sending Password in GET Request",
    "source": "CERT-PL",
    "references": "https://cert.pl/posts/2025/08/CVE-2025-54540\nhttps://opensolution.org",
    "id": "CVE-2025-54542",
    "bulletinFamily": "",
    "cwe": [
        "CWE-598"
    ],
    "cvelist": null,
    "sourceData": "OpenSolution QuickCMS 6.8",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "QuickCMS",
    "version": "6.8",
    "vendor": "OpenSolution",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}