← Vulnerability feed

Vulnerability record · CVE-2024-58308 · published 11 December 2025

CVE-2024-58308: Opensolution quick cms sql injection vulnerability

Opensolution · Quick Cms

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.

9.3 CVSS 4.0 Critical EPSS 0.67% · top 50.2% CWE-89 · SQL injection
9.3CVSS 4.0 base score
0.67%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip Exploit
https://www.exploit-db.com/exploits/51910 Exploit
https://www.opensolution.org Product
https://www.vulncheck.com/advisories/quickcms-sql-injection-authentication-bypass-via-admin-login Third Party Advisory

Track CVE-2024-58308 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2023-43345Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.36%5.4CVE-2023-43346Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.49%5.4CVE-2023-43342Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.49%5.4CVE-2023-43344Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.64%5.4CVE-2023-43343Opensolution quick cms cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to th…EPSS 0.68%4.3CVE-2012-6430Opensolution quick.cart cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows r…EPSS 3.9%9.8CVE-2026-76461Cisco AsyncOS email parsing SQL injection allows root command executionCisco AsyncOS Software for Cisco Secure Email Gateway fails to properly validate email parsing input, allowing crafted email messages containing mali…KEVEPSS 28%analysed9.3CVE-2026-9586Sangoma Switchvox unauthenticated SQL injection in /pa endpointSangoma Switchvox SMB Edition 8.3 (104997) fails to sanitize the PhoneIP value from XML content beginning with <PolycomIPPhone> before concatenating …KEVEPSS 19%analysed

Source: NIST National Vulnerability Database (record CVE-2024-58308), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.