A critical authentication bypass vulnerability in MaxSite CMS allows unauthenticated remote attackers to gain full administrative control over the application.

The application utilizes a hardcoded session encryption key in the configuration file that is never updated during installation, enabling attackers to forge valid administrator session cookies. By submitting a crafted cookie, an attacker can bypass authentication functions and manipulate database queries to assume administrative privileges.

Successful exploitation grants an attacker complete administrative control over the affected MaxSite CMS instance. This facilitates unauthorized access to sensitive site content, user databases, and configuration settings, which can lead to total system compromise, data theft, or the execution of further malicious payloads. Given the critical CVSS score of 9.8, the potential for immediate and total loss of confidentiality and integrity is severe.

Immediate Action: Upgrade to the latest version of MaxSite CMS where the hardcoded key has been removed and secure session handling is implemented. If an update is not immediately possible, manually rotate the encryption key in application/config/config.php to a unique, cryptographically strong value.

Proactive Monitoring: Monitor server access logs for anomalous requests to the /admin/ path and inspect session cookie patterns for signs of tampering. Review database logs for unexpected query structures that may indicate attempts to exploit the session re-validation flaw.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious or malformed session cookies. Ensure the application is configured to use server-side session storage (setting sess_use_database = TRUE) to limit the effectiveness of client-side cookie forgery.

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the referenced research write-up on GitHub.

This vulnerability represents a critical security failure that permits total administrative takeover without authentication. IT administrators must prioritize updating their MaxSite CMS deployments immediately. If an update cannot be performed today, perform a manual key rotation and apply strict perimeter filtering to protect the administrative interface from external access.