CVE-2026-3395
Remote Code Injection in MaxSite CMS MarkItUp Preview Endpoint
Publication date: 2026-03-01
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| max-3000 | maxsite_cms | to 109.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3395 is a critical remote code injection vulnerability in MaxSite CMS versions up to 109.1, specifically in the MarkItUp Preview AJAX Endpoint located at application/maxsite/admin/plugins/editor_markitup/preview-ajax.php.
The vulnerability arises because user input is passed unsafely to the eval function without proper authentication or input sanitization, allowing attackers to inject and execute arbitrary PHP code remotely.
This means an attacker can send specially crafted requests to the preview AJAX endpoint and execute any PHP code on the server with the privileges of the web server process.
The issue is due to improper control of code generation (CWE-94) and is exploitable without authentication, making it highly dangerous.
The vulnerability was fixed in MaxSite CMS version 109.2 by enforcing authentication checks and referer validation on the affected AJAX endpoints.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary code on the affected server without any authentication.
- Attackers can fully compromise the CMS, including accessing and modifying content, user accounts, configurations, and databases.
- It impacts the confidentiality, integrity, and availability of the system.
- Attackers may achieve persistence or lateral movement within the network depending on system defenses.
- Exploitation is straightforward and publicly documented, increasing the risk of widespread attacks.
Overall, this vulnerability poses a critical security risk that can lead to complete system takeover.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying if your MaxSite CMS installation is running a vulnerable version (up to 109.1) and if the MarkItUp Preview AJAX Endpoint at application/maxsite/admin/plugins/editor_markitup/preview-ajax.php is accessible without authentication.'}, {'type': 'paragraph', 'content': 'One practical detection method is to use Google dorking with the query: inurl:application/maxsite/admin/plugins/editor_markitup/preview-ajax.php to find potentially vulnerable targets.'}, {'type': 'paragraph', 'content': "On your network or system, you can test the endpoint by sending a crafted POST request to the preview-ajax.php endpoint with a payload containing PHP code inside [php]...[/php] tags, for example: [php]echo 'RCE_OK';[/php]. If the response contains 'RCE_OK', it confirms the vulnerability."}, {'type': 'paragraph', 'content': 'Commands using curl to test the vulnerability might look like this:'}, {'type': 'list_item', 'content': 'curl -X POST -d "data=[php]echo \'RCE_OK\';[/php]" https://target-site/application/maxsite/admin/plugins/editor_markitup/preview-ajax.php'}, {'type': 'paragraph', 'content': "If the response includes the string 'RCE_OK', the system is vulnerable."}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade MaxSite CMS to version 109.2 or later, which includes the patch that fixes this vulnerability by enforcing authentication and referer checks on the affected AJAX endpoints.
If upgrading immediately is not possible, consider the following temporary mitigations:
- Restrict access to the preview-ajax.php endpoint by implementing authentication checks or IP-based access controls.
- Disable or remove the run_php plugin or any plugin that allows execution of PHP code via user input.
- Implement web application firewall (WAF) rules to block requests containing suspicious payloads such as [php] tags.
- Add CSRF protection and verify HTTP referer headers to prevent unauthorized AJAX requests.