Executive brief
MaxSite CMS, a PHP-based content management system, deserializes session data without proper class restrictions and uses a hardcoded encryption key. An attacker can forge session cookies to inject PHP objects or forge admin sessions, potentially leading to unauthorized administrative access or remote code execution if suitable gadget classes are present in the application's dependencies.
Technical details
MaxSite CMS contains a multi-stage vulnerability chain: (1) a hardcoded encryption key ('encryption key') used for HMAC-SHA1 signing of session cookies, allowing attackers to forge valid ci_session cookies with arbitrary content; (2) unsafe unserialize() calls in Session.php:742 and other locations that lack the ['allowed_classes' => false] guard, enabling PHP object injection; and (3) database re-validation logic that accepts malformed ciphertext (which decrypts to boolean false) and converts it to SQL integer 0, bypassing authentication checks via string-to-integer type coercion. Attack requires no authentication or user interaction. An attacker can forge an admin session cookie or inject malicious serialized objects; if gadget classes exist in deployed dependencies, arbitrary code execution is possible. Patches should replace all unserialize() calls with safe equivalents and fix the database validation logic.
Affected products
- MaxSite CMS through 109.6
Timeline
- 2026-09-09: disclosed: CVE-2026-87930 published; advisory disclosed