CVE-2026-70553

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/maxsite/cms
https://max-3000.com/page/maxsite-cms-109-6
https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) MaxSite CMS contiene una vulnerabilidad de ejecución remota de código que permite a atacantes no autenticados inyectar código PHP arbitrario en el archivo de configuración de la aplicación mediante el envío de solicitudes POST manipuladas al endpoint de instalación una vez completada la instalación. Los atacantes pueden proporcionar un valor db_dbprefix malicioso que contenga una comilla simple para escapar de un literal de cadena de PHP en application/config/database.php, añadiendo sentencias PHP controladas por el atacante que son ejecutadas por el servidor web en cada solicitud subsiguiente, lo que resulta en una ejecución remota de código persistente y no autenticada como el usuario del proceso del servidor web.

Information

Published : 2026-08-04 20:16

Updated : 2026-10-24 15:10

NVD link : CVE-2026-70553

Mitre link : CVE-2026-70553

CVE.ORG link : CVE-2026-70553

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-70553", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70553", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T19:04:20.288638Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "MaxSite", "product": "MaxSite CMS", "versions": [{"status": "affected", "version": "105.2", "versionType": "custom", "lessThanOrEqual": "109.5"}, {"status": "unaffected", "version": "109.6", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-08-04T20:16:56.023", "references": [{"url": "https://github.com/maxsite/cms", "source": "disclosure@vulncheck.com"}, {"url": "https://max-3000.com/page/maxsite-cms-109-6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user."}, {"lang": "es", "value": "MaxSite CMS contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que permite a atacantes no autenticados inyectar c\u00f3digo PHP arbitrario en el archivo de configuraci\u00f3n de la aplicaci\u00f3n mediante el env\u00edo de solicitudes POST manipuladas al endpoint de instalaci\u00f3n una vez completada la instalaci\u00f3n. Los atacantes pueden proporcionar un valor db_dbprefix malicioso que contenga una comilla simple para escapar de un literal de cadena de PHP en application/config/database.php, a\u00f1adiendo sentencias PHP controladas por el atacante que son ejecutadas por el servidor web en cada solicitud subsiguiente, lo que resulta en una ejecuci\u00f3n remota de c\u00f3digo persistente y no autenticada como el usuario del proceso del servidor web."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}