Description

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-09T17:17:53.840Z",
  "pubdate": "2026-09-09T17:17:53.840Z",
  "executiveSummary": "MaxSite CMS through version 109.6 contains a critical security vulnerability involving the use of a hardcoded encryption key within the application configuration.\nThis vulnerability is classified as an improper use of cryptographic primitives, specifically related to static credentials.\nBecause the encryption key is universal and hardcoded in 'application/config/config.php', it remains consistent across all installations of the affected software versions.\nThe vulnerability allows an unauthenticated, remote attacker to perform session forgery.\nBy leveraging knowledge of the static key, an attacker can construct malicious 'ci_session' cookies that appear valid to the server.\nThis bypasses established authentication mechanisms, specifically the 'is_login()' and 'mso_check_allow()' functions.\nSuccessful exploitation results in unauthorized administrative access, allowing the attacker to fully compromise the CMS, modify content, inject malicious code, or extract sensitive data.\nThis represents a high-severity risk as it requires no prior authentication or administrative privileges to execute.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the CodeIgniter session handling mechanism within MaxSite CMS. The application stores its cryptographic signing/encryption key in 'application/config/config.php' as a static, non-unique string that is not regenerated upon installation.\nBecause this key is publicly discoverable—often found within the application source code—it fails to provide the necessary entropy or confidentiality required to secure session data.\nThe 'ci_session' cookie is typically signed or encrypted using this key to ensure integrity and authenticity. An attacker can reverse-engineer the session structure or utilize publicly available tools to compute the HMAC-SHA1 signature required by the application's session handler.\nThe attack flow proceeds as follows: First, the attacker identifies a target MaxSite CMS instance running version 109.6 or earlier. Second, the attacker acquires the known static encryption key from the source code. Third, the attacker crafts a serialized session object containing administrative identifiers, such as 'user_id=1' or 'is_admin=true'.\nFinally, the attacker computes the valid HMAC-SHA1 signature for this payload using the compromised key and submits the forged 'ci_session' cookie in an HTTP request. When the application executes 'is_login()' or 'mso_check_allow()', it uses the static key to verify the cookie. Since the signature matches, the server treats the malicious cookie as an authenticated session from an administrator.\nThis vulnerability is exposed via the web interface and does not require local system access. The impact is a complete authentication bypass, which grants the attacker the ability to manage the CMS backend, upload arbitrary files, or modify system configurations, leading to remote code execution or total data exfiltration.\nThe vulnerability persists because the session management logic relies entirely on the secrecy of this hardcoded key, which is invalidated once the code is distributed."
}