CVE-2026-70553 Overview
CVE-2026-70553 is an unauthenticated remote code execution vulnerability in MaxSite CMS. The flaw resides in the install endpoint, which remains reachable after installation completes. Attackers submit crafted POST requests that inject arbitrary PHP into application/config/database.php through the db_dbprefix parameter. The web server then executes the injected code on every subsequent request as the web-server process user. The issue is classified as CWE-94 (Improper Control of Generation of Code) and carries a CVSS 4.0 score of 9.3.
Critical Impact
Unauthenticated attackers gain persistent PHP code execution on affected MaxSite CMS installations, leading to full application and web-server compromise.
Affected Products
- MaxSite CMS (see GitHub Repository for CMS)
- MaxSite CMS distribution referenced at Max-3000
- Installations where the install endpoint remains reachable after setup
Discovery Timeline
- 2026-08-04 - CVE-2026-70553 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70553
Vulnerability Analysis
The vulnerability exists in the MaxSite CMS installation workflow. The install endpoint accepts POST parameters that write directly into the PHP configuration file application/config/database.php. The endpoint remains callable after installation completes, giving unauthenticated network attackers a persistent entry point. Because the configuration file is loaded by the framework on every request, injected PHP statements run automatically after a single successful write. The result is persistent unauthenticated code execution as the web-server user, with no interaction required from any operator.
Root Cause
The install handler places user-supplied values into the generated configuration file without escaping PHP metacharacters. The db_dbprefix field is written inside a single-quoted PHP string literal. A submitted single quote closes the literal, and any characters that follow become executable PHP source code. The installer neither validates that setup has already completed nor sanitizes the input before writing to disk, which turns a first-run helper into a permanent code injection primitive.
Attack Vector
An attacker sends an HTTP POST request to the install endpoint over the network. The request contains a db_dbprefix value beginning with a single quote, followed by attacker-controlled PHP statements. The installer serializes the value into application/config/database.php, breaking out of the string literal and appending live PHP code. On the next HTTP request that loads database configuration, the web server evaluates the injected statements. See the VulnCheck Advisory: MaxSite CMS RCE for technical details of the request structure.
Detection Methods for CVE-2026-70553
Indicators of Compromise
- Unexpected modification timestamps or contents in application/config/database.php, particularly PHP statements appearing after the db_dbprefix assignment.
- HTTP POST requests to the install endpoint after initial deployment, especially from external IP addresses.
- Outbound network connections initiated by the web-server process (php-fpm, apache, www-data) to unfamiliar hosts.
- New PHP files, webshells, or scheduled tasks created under the CMS document root by the web-server user.
Detection Strategies
- Alert on writes to application/config/*.php by any process other than an administrator during scheduled maintenance windows.
- Inspect web-server access logs for POST requests targeting the installer path and containing db_dbprefix parameters with quote or PHP tag characters.
- Baseline the SHA-256 hash of database.php after installation and continuously verify integrity.
Monitoring Recommendations
- Ingest web-server and PHP error logs into a centralized SIEM and correlate installer-path requests with subsequent process spawns.
- Monitor the web-server user for anomalous child processes such as sh, bash, curl, wget, or python.
- Track outbound egress from public-facing PHP hosts and flag connections that follow write events to configuration files.
How to Mitigate CVE-2026-70553
Immediate Actions Required
- Remove or restrict access to the MaxSite CMS installer directory once installation completes.
- Audit application/config/database.php for injected PHP statements and restore a known-good copy from source control if tampering is confirmed.
- Block external access to the install endpoint at the reverse proxy or web application firewall.
- Rotate database credentials and any secrets stored in the configuration file after remediation.
Patch Information
No vendor-published fixed version is referenced in the NVD entry at time of publication. Monitor the MaxSite CMS GitHub repository and the Max-3000 release page for security updates, and apply patches as soon as they are released.
Workarounds
- Delete the installer files from production deployments immediately after setup.
- Enforce WAF rules that deny POST requests to installer paths and reject payloads containing single quotes or <?php sequences in configuration parameters.
- Set application/config/database.php to read-only for the web-server user and revoke write permissions to the configuration directory.
- Restrict access to the CMS host to trusted networks during initial installation and re-lock the environment before exposure to the public internet.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
