EUVD-2026-49766
GHSA-5v73-8v9g-j67x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to server
-
DeliveryLocate configuration file
-
ExploitRead plaintext admin credentials
-
ExecutionAuthenticate as admin
-
ImpactEscalate privileges via admin panel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential storage protection
|
| Exploitation Conditions | Requires file-system access to the server running Quick.Cart, specifically read permission on the configuration file that stores admin credentials. The attacker must have a local user account or have exploited another vulnerability to gain local access. No special Quick.Cart configuration settings are needed beyond default installation; the vulnerability exists in the standard setup. Limiting factor: remote unauthenticated exploitation is not possible-the attack vector is strictly local. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) yields a base score of 6.8, reflecting a local, low-complexity attack with low privileges required, resulting in high confidentiality impact but no other impacts. The vendor has assessed exploitation likelihood as very low and declined to fix, which aligns with the need for prior local access. No EPSS score, KEV listing, or proof-of-concept code is available, indicating this is a low-priority risk in practice-exploitation is unlikely unless an attacker already has a foothold on the server. |
| Exploit ScenarioDerived | An attacker who gains local shell access to the server (e.g., via an unrelated web shell or compromised SSH account) reads the Quick.Cart configuration file, extracts the plaintext admin username and password, then logs into the admin panel to alter product listings, exfiltrate customer data, or pivot to further server compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Privilege escalation in Quick.Cart via hard-coded, plaintext admin credentials stored in a configuration file allows local attackers with file system access to retrieve authentication details and gain administrative control. The vendor considers exploitation unlikely and has not released a fix; all versions are believed vulnerable, with version 6.7 confirmed. No public exploit or active exploitation has been reported.
RemediationAI
No vendor-released patch exists; the vendor deemed a fix unnecessary. Compensating controls include: restricting file-system permissions on the configuration file (e.g., chmod 600 and owned by the web server user) to prevent unauthorized reads; implementing file integrity monitoring (e.g., auditd) to detect access; rotating admin credentials regularly and storing them in environment variables or a secrets manager (e.g., HashiCorp Vault) instead of plaintext files. These measures add administrative overhead but mitigate the exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-256 (Plaintext Storage of a Password), where the application stores administrator credentials in a configuration file without encryption. The CPE cpe:2.3:a:opensolution:quick.cart:*:*:*:*:*:*:* indicates all versions of the Quick.Cart shopping cart are affected. This design flaw exposes credentials to any local user who can read the file system, violating the principle of secure credential storage.
Know when Quick Cart gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Local access required, low complexity, attacker needs system-level privilege (PR:L), no user interaction.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Only version 6.7 was tested but all versions should be considered as vulnerable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Quick Cart
View allCross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded befor
Session fixation vulnerability in Quick.Cart allows attackers to set a user's session identifier before authentication.
Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart
Cross-site request forgery in OpenSolution Quick.Cart's admin configuration panel allows an attacker-controlled web page
Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when ope
Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invali
Quick.Cart version 6.7 stores user passwords in plaintext, allowing authenticated administrators to retrieve plaintext c
Exploit-DB