Executive brief
MaxSite CMS is a free website content management system used to build and manage websites. An unauthenticated attacker can inject arbitrary PHP code into the application by exploiting the install endpoint after the system is already installed, allowing them to execute malicious commands with web server privileges on every subsequent request. This gives attackers complete control over the web server and all data it manages.
Technical details
The vulnerability is a PHP code injection flaw in the install endpoint (install/index.php or similar) that remains accessible after initial installation. An unauthenticated attacker can submit a crafted POST request with a malicious db_dbprefix parameter containing a single quote to break out of a PHP string literal in the application/config/database.php configuration file. By injecting properly-formatted PHP code, the attacker appends arbitrary statements that are parsed and executed by the web server on every subsequent application request. The attack requires network access to the install endpoint but no authentication or user interaction. The injected code executes with the privileges of the web server process, enabling persistent remote code execution.
Affected products
- MaxSite CMS 109.5 and earlier
Timeline
- 2026-08-04: disclosed
- 2026-03-16: patched: MaxSite CMS 109.6 released as security update