MaxSite CMS vulnerabilities

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation. Attackers can use gadget chains such as SoapClient or Imagick for remote code execution.

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation. Attackers can exploit the db_dbprefix value to break out of a PHP string literal and add their own code.

MaxSite CMS 109.5 and earlier contain an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path to any *-ajax.php file. This can enable manipulation of poll states and vote counts.

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when accessed, enabling persistent stored XSS attacks.

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.

Cross-Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page.

A vulnerability was found in MaxSite CMS up to 109.3. An unknown function of the ushki Plugin component is impacted. Manipulation of the f_ushka_new/f_ushk argument results in cross site scripting, remote exploitation is possible, and the exploit has been made public. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A vulnerability has been found in MaxSite CMS up to 109.3. Some unknown processing of the Guestbook Plugin component is affected. Manipulation of the f_text/f_slug/f_limit/f_email argument leads to cross site scripting, the attack may be launched remotely, and the exploit has been disclosed publicly. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A flaw was found in MaxSite CMS up to 109.3 in the down_count Plugin. Manipulation of the f_file/f_prefix arguments leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.

A security vulnerability has been detected in MaxSite CMS up to 109.3. Some unknown functionality of the mail_send Plugin component is affected. Manipulation of the f_subject/f_files/f_from argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A vulnerability was detected in MaxSite CMS up to 109.3 in the Redirect Plugin. Manipulation of the f_all/f_all404 arguments leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.

A weakness was identified in MaxSite CMS up to 109.3 in an unknown functionality of the /admin/plugin_antispam file of the Antispam Plugin. Manipulation of the f_logging_file argument can lead to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.

A flaw was found in MaxSite CMS up to 109 affecting unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Manipulation of the file_path/content arguments can lead to unrestricted file upload. The attack can be executed remotely and the exploit has been published. The vendor was contacted but did not respond.

A vulnerability was detected in MaxSite CMS up to 109 affecting unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the HTTP Header Handler component. Manipulation of the X-Requested-FileName/X-Requested-FileUpDir arguments results in unrestricted file upload. Remote exploitation is possible and the exploit is now public. The vendor was contacted but did not respond.