Unauthenticated Remote Code Execution in MaxSite CMS via Config Injection

MaxSite CMS contains a critical remote code execution vulnerability (CVE-2026-70553) affecting the application's installation process. An unauthenticated attacker can exploit this flaw by submitting crafted POST requests to the CMS installation endpoint, even after the initial installation is complete. By providing a specifically crafted 'db_dbprefix' parameter containing a single quote, an attacker can break out of the PHP string literal within 'application/config/database.php'. This allows for the injection and subsequent execution of arbitrary PHP code. The injected payload is written to the configuration file and is executed by the web server process during every subsequent application request, granting the attacker persistent code execution capabilities with the privileges of the web service account.

Impact

Successful exploitation results in full server-side compromise, as the attacker achieves unauthenticated remote code execution. This allows for data exfiltration, lateral movement within the network, or complete takeover of the affected web application. This vulnerability poses a severe risk to any organization running an exposed MaxSite CMS instance.

Recommendation

• Patch MaxSite CMS to the latest version provided by the vendor to address the improper input sanitization in the installation module.
• Review the 'application/config/database.php' file for any anomalous PHP code or unexpected modifications to the 'db_dbprefix' variable.
• Restrict access to the CMS installation endpoint (e.g., /install) via web application firewall or server configuration rules after the initial site setup is complete.
• Audit web server logs for suspicious POST requests targeting installation directories that occur outside of documented deployment windows.