MaxSite CMS contains a critical deserialization vulnerability that allows unauthenticated attackers to achieve remote code execution through malicious cookie payloads.

This is a deserialization of untrusted data vulnerability (CWE-502). The application passes the maxsite_comuser cookie directly to the unserialize function without validation, enabling attackers to inject malicious objects that trigger remote code execution.

This vulnerability carries a CVSS score of 9.8, reflecting its potential for full system compromise. An attacker can gain control over the underlying server, leading to complete data exfiltration, service disruption, and potential lateral movement within the network.

Immediate Action: Upgrade MaxSite CMS to version 109.6 or later, which contains the necessary security fixes to address this deserialization flaw.

Proactive Monitoring: Review web server logs for suspicious cookie values containing serialized PHP objects, which often appear as complex strings starting with O: or C:.

Compensating Controls: Utilize a Web Application Firewall to inspect incoming cookie headers and filter out serialized PHP objects that match known attack patterns.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates an immediate upgrade to version 109.6. Failure to patch will leave the application open to trivial remote code execution attacks by any unauthenticated user on the internet.