Description

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-09T17:17:53.990Z",
  "pubdate": "2026-09-09T17:17:53.990Z",
  "executiveSummary": "MaxSite CMS through version 109.6 is susceptible to an unauthenticated PHP object injection vulnerability stemming from the unsafe deserialization of the ci_session cookie.\nThe application passes user-supplied session data directly to the unserialize() function without implementing proper class restrictions or integrity validation.\nBecause the system utilizes a hardcoded encryption key, an attacker can generate a forged, cryptographically valid session cookie containing a malicious serialized PHP object.\nSuccessful exploitation allows for the execution of arbitrary code via POP (Property-Oriented Programming) chains if suitable gadget classes exist within the application's codebase or included libraries.\nThis vulnerability poses a critical risk to the integrity and availability of the system, potentially granting an unauthenticated remote attacker full control over the application environment.\nExploitation is highly feasible due to the static nature of the encryption key, requiring no prior authentication or administrative privileges to execute the attack vector over the network.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of the ci_session cookie by MaxSite CMS. The application architecture allows for the deserialization of session data using the native PHP unserialize() function. Crucially, this operation is performed without any allow-listing of permitted classes, rendering the application susceptible to PHP Object Injection.\nThe attack vector is facilitated by the presence of a hardcoded encryption key within the application configuration or codebase. By obtaining this key, an attacker can bypass the encryption layer protecting the session cookie. This allows the construction of a custom, malicious serialized PHP payload that, when decrypted and processed by the application, is treated as a legitimate session object.\nThe attack flow proceeds as follows: First, the attacker identifies the hardcoded encryption key used to protect the ci_session. Second, the attacker crafts a malicious serialized PHP object designed to leverage available gadget chains—classes already present within the MaxSite CMS or its dependencies that implement magic methods such as __destruct(), __wakeup(), or __toString(). Third, the attacker signs the payload using the discovered encryption key to ensure it passes the initial integrity check. Fourth, the attacker injects this forged cookie into an HTTP request. Finally, when the application calls unserialize() on the decrypted input, the PHP engine instantiates the malicious object, triggering the associated magic methods and executing the gadget chain.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated privileges. The scope of the post-exploitation impact depends on the complexity of the available gadget chains, ranging from simple denial-of-service through state corruption to full Remote Code Execution (RCE). As the vulnerable component is the core session management mechanism, the attack is exposed to any network entity capable of reaching the web server. The affected versions include all releases of MaxSite CMS up to and including 109.6, as they all rely on this insecure session handling mechanism."
}