MaxSite CMS (<= 109.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/maxsite-cms--109.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 09 Sep 2026 19:02:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal File Inclusion in MaxSite CMS via Ajax Dispatchershttps://feed.craftedsignal.io/briefs/2026-09-maxsite-lfi/Wed, 09 Sep 2026 19:02:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-maxsite-lfi/MaxSite CMS versions up to 109.6 contain a local file inclusion vulnerability in its ajax and require-maxsite dispatchers allowing unauthenticated attackers to execute arbitrary privileged handlers.MaxSite CMS versions up to and including 109.6 are affected by a critical local file inclusion (LFI) vulnerability residing within the system's ajax and require-maxsite dispatchers. This flaw allows unauthenticated, remote attackers to bypass existing path validation mechanisms by supplying base64-encoded path traversal sequences. By successfully manipulating these request parameters, an adversary can force the application to load and execute internal, privileged handler files. Because these handlers often contain administrative functionality, successful exploitation grants the attacker unauthorized access to sensitive application features or administrative actions that should remain gated behind proper authentication. Defenders should prioritize patching, as this vulnerability provides a direct pathway for unauthenticated remote code execution or privilege escalation depending on the target handler logic.

Impact

Successful exploitation of CVE-2026-87927 allows unauthenticated attackers to bypass security boundaries and execute privileged administrative functions within the MaxSite CMS environment. This can lead to full administrative takeover, unauthorized access to sensitive data, and potential remote code execution by leveraging internal handler scripts.

Recommendation

  • Upgrade MaxSite CMS to a version beyond 109.6 immediately as soon as a security patch is provided by the vendor.
  • Implement strict input validation on all ajax and require-maxsite endpoints to detect and reject base64-encoded strings or character sequences indicative of path traversal (e.g., ../, ..).
  • Deploy WAF rules to identify and block incoming HTTP requests containing base64-encoded strings in parameters targeting the /ajax/ or /require-maxsite/ URI paths.
]]>highadvisoryweb-applicationlfivulnerabilityHardcoded Session Encryption Key in MaxSite CMShttps://feed.craftedsignal.io/briefs/2026-09-maxsite-hardcoded-key/Wed, 09 Sep 2026 19:01:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-maxsite-hardcoded-key/MaxSite CMS versions 109.6 and earlier contain a hardcoded encryption key in application/config/config.php, enabling unauthenticated attackers to forge administrator session cookies.MaxSite CMS versions up to and including 109.6 are vulnerable to an authentication bypass due to a hardcoded session encryption key stored in the application/config/config.php file. Because this key remains static across all installations, an unauthenticated remote attacker can reconstruct the session cookie structure. By computing an HMAC-SHA1 signature using the discovered key, an attacker can generate a forged 'ci_session' cookie that grants administrator privileges. This flaw effectively bypasses critical authentication and authorization checks within the application's core functions, specifically is_login() and mso_check_allow(). This vulnerability presents a critical risk as it allows full unauthorized control of the CMS administrative interface.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain full administrative access to the MaxSite CMS instance. This can lead to complete site takeover, unauthorized access to user data, modification of content, or the injection of malicious code into the web environment. The scope of targeting includes all public-facing instances of MaxSite CMS version 109.6 and below.

Recommendation

Prioritized actions for security and IT teams:

  • Upgrade MaxSite CMS to the latest version that remediates CVE-2026-87929.
  • Review web server access logs for anomalous session cookie patterns, specifically 'ci_session' tokens that differ in structure or origin from established baseline traffic.
  • Audit the 'application/config/config.php' file on all deployed instances to verify if a unique, site-specific encryption key has been configured, overriding the default.
]]>criticaladvisorywebcveauthentication-bypass