Path Traversal in MaxSite CMS

Executive Summary

This is a local file inclusion vulnerability in MaxSite CMS versions up to 109.6. It exists in the ajax and require-maxsite dispatchers where unauthenticated attackers can execute privileged handler files by providing base64-encoded path traversal sequences. The flaw allows bypassing path validation checks to run admin-gated handler actions without authentication, gaining access to sensitive functionality.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to ajax.php or require-maxsite.php with base64-encoded path traversal sequences in the URI. Check server logs for unusual file inclusion attempts or unauthorized access to privileged handler files. Use tools like Wireshark or tcpdump to capture and analyze HTTP requests containing base64 strings with ../ sequences.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to include and execute arbitrary PHP files on the server, potentially leading to remote code execution if writable files are targeted. Even without direct code execution, sensitive admin functionality could be accessed, compromising the entire CMS installation and its data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA by enabling unauthorized access to sensitive data and administrative functions. It could lead to data breaches, unauthorized modifications, and loss of control over protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MaxSite CMS to the latest patched version. If no patch is available, disable the ajax and require-maxsite dispatchers in the web server configuration. Implement strict input validation to reject base64-encoded strings containing path traversal sequences like ../. Restrict file inclusion to an explicit allowlist of permitted handler files.

Useful 0 Not Useful 0