An unauthenticated local file inclusion vulnerability in MaxSite CMS allows remote attackers to execute privileged handler files, posing a high risk of unauthorized system access.

The application incorrectly uses a substring check to validate file paths constructed from base64-encoded user input. This flaw allows an unauthenticated attacker to bypass directory restrictions and include arbitrary PHP files, such as admin-gated handler actions, leading to potential code execution.

Successful exploitation allows an unauthenticated actor to execute arbitrary PHP code within the context of the web server. This can lead to full system compromise, unauthorized data access, and the bypass of critical administrative authentication gates. With a CVSS score of 8.2, this vulnerability represents a high-severity risk that could facilitate complete loss of application integrity.

Immediate Action: Update MaxSite CMS to the latest version that implements a robust path validation mechanism, such as using realpath() to verify the target file resides within the intended directory.

Proactive Monitoring: Monitor server access logs for requests containing base64-encoded strings within the URL path, particularly those directed at the ajax or require-maxsite dispatchers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing directory traversal sequences (e.g., ../) or suspicious base64-encoded payloads directed at these specific endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by EviL0rd.

Given the availability of a functional proof-of-concept and the ease of exploitation by unauthenticated remote attackers, this vulnerability should be prioritized for immediate remediation. Organizations using MaxSite CMS must ensure their installations are updated to a patched version and evaluate if their current directory validation logic is susceptible to the described substring bypass.