CyberRota Analysis
AI-GeneratedMaxSite CMS is vulnerable to a critical PHP object injection flaw that allows unauthenticated attackers to execute arbitrary code by sending crafted serialized data through the maxsite_comuser cookie. This vulnerability can be exploited in a single HTTP request, potentially leading to remote code execution via various PHP gadget chains. Organizations using MaxSite CMS should prioritize patching this vulnerability to mitigate the risk of unauthorized access and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.