A critical remote code execution vulnerability in MaxSite CMS allows unauthenticated attackers to inject and execute arbitrary PHP code via the installation endpoint.

This is a code injection vulnerability (CWE-94) where an attacker can supply a crafted database prefix containing a single quote to break out of a PHP string literal. This allows for the persistent injection of arbitrary PHP statements into the application configuration file, which are subsequently executed by the web server.

Successful exploitation results in unauthenticated remote code execution with the privileges of the web server process. This provides an attacker with complete control over the application environment, enabling data theft, site defacement, and further compromise of the underlying server infrastructure.

Immediate Action: Upgrade MaxSite CMS to version 109.6 or later immediately to resolve the injection vulnerability.

Proactive Monitoring: Review application configuration files for signs of tampering or unexpected PHP code blocks, and check web server logs for suspicious POST requests to the installation endpoint.

Compensating Controls: Restrict access to the installation endpoint at the web server level if an immediate upgrade is not feasible.

Public Exploit Available: Unknown

Organizations using MaxSite CMS must prioritize upgrading to version 109.6. This is a critical security update that addresses a direct path to server compromise, and delaying the update leaves the application exposed to remote attackers.