CVE-2024-58308 is a critical (CVSS 9.8) SQL injection in Quick.CMS 6.7 from OpenSolution. The admin login form passes input into a database query, so an unauthenticated visitor can bypass authentication and reach the admin area. The record names no fixed release, so check the vendor and take the admin panel off the open internet.
What's affected
The NVD record lists Quick.CMS version 6.7, a small PHP content management system from OpenSolution. It describes an unauthenticated SQL injection in the login form that allows login authentication to be bypassed and administrative access to be gained.
The record does not name a fixed version, and the vendor download link in the references points at the 6.7 package. That means we cannot confirm a patched release from the sources, so do not assume a newer download fixes it until the vendor says so. Check the OpenSolution site and the VulnCheck advisory for current status.
A public exploit listing exists for this issue according to the record's references, which raises the practical risk even though the record does not mark the CVE as known exploited.
How to check if you're exposed
Start by finding out whether you run Quick.CMS at all, and which version.
- Look for a Quick.CMS install in your web hosting accounts and old project folders. Small CMS installs are often forgotten.
- Open the package files or the admin footer to read the version string. Version 6.7 is the one named in the record.
- Check your web server access logs for repeated requests to the admin login page, and for login requests that succeed from unfamiliar addresses.
- Review the list of admin accounts and recent content changes for anything you did not make.
If you cannot tell whether a site was touched, treat the database as exposed, rotate the admin password and any credentials stored in the database, and compare the site files with a clean copy.
What to do now
- Inventory every Quick.CMS install and confirm its version.
- Restrict the admin path to known IP addresses or put it behind HTTP authentication or a VPN until a fix is confirmed.
- Contact OpenSolution or read the VulnCheck advisory for the status of a patched release.
- Put a web application firewall rule in front of the login form if you have one.
- Rotate admin passwords and review the admin account list and recent edits.
- If the site is no longer needed, take it offline.
Why it matters
SQL injection happens when user input is placed into a database query as code rather than as data. On a login form this is especially bad, because the query that checks the password can be made to succeed without the password.
The fix pattern is old and well known: parameterized queries so that input can never change the structure of the statement. A login form that builds its query by joining strings is a sign that other parts of the application may do the same, so a single patch on one form may not be the end of the review.
The weakness class is CWE-89: SQL Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Is Quick.CMS 6.7 the only affected version?
The record lists 6.7. Other versions are not mentioned, so ask the vendor rather than assuming older or newer ones are safe.
Can I just hide the login page?
Moving it helps, but it is not a fix. Restrict it by network and plan to patch or replace the software.
Sources
Last reviewed: 19 October 2026.
