Summary
MaxSite CMS 109.5 and earlier contains a critical authentication bypass in its AJAX dispatcher. An unauthenticated attacker may reach administrator-gated plugin endpoints by providing an accepted X-Requested-With header and a base64-encoded path targeting an AJAX PHP file, potentially enabling unauthorized state changes or other privileged operations.
Affected context
The vulnerability occurs in MaxSite CMS deployments using the affected AJAX dispatcher and plugin endpoints that rely on dispatcher-level authentication checks. Risk is present when an attacker can submit requests to the dispatcher, the request satisfies its header and path-handling conditions, and the resolved target is an admin-gated *-ajax.php file whose own authorization controls are insufficient.
Exploit preconditions
- Attack surface: The MaxSite CMS AJAX dispatcher and reachable plugin AJAX handlers
- Required access: No valid account or prior authentication is generally required
- Trigger point: A dispatcher request containing an accepted
X-Requested-Withheader and a base64-encoded path resolving to a*-ajax.phpfile - Why exploitation is possible: The dispatcher can route the request to privileged AJAX functionality without reliably enforcing authentication before dispatch
Why this happens
The underlying bug is an authentication enforcement failure in request dispatch. The AJAX dispatcher treats request metadata and a decoded file path as sufficient conditions for routing, while privileged handlers may be reachable without an effective authentication or authorization check. This maps to CWE-306: Missing Authentication for Critical Function, because sensitive functionality can be invoked without establishing the identity of the requester.
Potential impact
- Unauthenticated attackers may access administrator-gated AJAX operations
- Poll states and vote counts could be manipulated
- Plugin-specific privileged actions may be performed without authorization
- Additional dangerous operations exposed through plugin AJAX files could be abused
- Application integrity, availability, or administrative control may be affected
General mitigation guidance
Mitigation generally focuses on enforcing authentication and authorization at every privileged operation rather than relying only on dispatcher behavior.
Common defensive patterns include:
- Require an authenticated session and appropriate authorization capability before executing each sensitive AJAX handler
- Use an explicit allowlist of callable actions instead of resolving arbitrary filesystem paths
- Treat request headers, encoded paths, and client-controlled routing values as untrusted input
- Apply strict path normalization and reject unexpected files or traversal-like resolutions
- Use deny-by-default access controls for administrative endpoints
- Run application components with the minimum database and filesystem privileges they require
- Protect state-changing requests with appropriate CSRF defenses in addition to authentication
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Static analysis for AJAX dispatchers that route client-controlled paths or invoke handlers without authorization checks
- Code review searches for administrative endpoints lacking explicit authentication and capability checks
- Dynamic tests that submit unauthenticated requests to every AJAX action and verify consistent access denial
- Web application firewall or gateway policies restricting administrative AJAX routes and unexpected routing parameters
- Audit logging and alerting for unauthenticated requests that reach privileged plugin handlers
Automated security review tools may help identify missing authorization checks, but endpoint-level testing is important for validating dispatcher behavior.
