CyberRota Analysis
AI-GeneratedMaxSite CMS versions up to 109.6 contain a hardcoded session encryption key in the configuration file, which remains unchanged during installation. This vulnerability allows unauthenticated attackers to forge administrator session cookies, effectively bypassing authentication and gaining unauthorized access to administrative functions. Organizations using MaxSite CMS should prioritize this issue to prevent potential exploitation and unauthorized access to sensitive administrative capabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.