Summary
MaxSite CMS contains a critical PHP object injection vulnerability caused by deserializing attacker-controlled data from the maxsite_comuser cookie without validation or class allowlisting. An unauthenticated attacker may send a crafted HTTP request that triggers dangerous magic methods during object reconstruction, potentially enabling remote code execution when suitable gadget chains are available.
Affected context
The vulnerability occurs in MaxSite CMS deployments where the maxsite_comuser cookie is accepted from an unauthenticated client and passed directly to PHP's unserialize() function. Risk is highest when the application runtime contains usable gadget chains, such as those involving available SoapClient or Imagick functionality, and when the web process has meaningful system privileges.
Exploit preconditions
- Attack surface: HTTP requests handled by the MaxSite CMS application
- Required access: No authentication may be required if the vulnerable cookie-processing path is publicly reachable
- Trigger point: Processing the attacker-controlled
maxsite_comusercookie - Why exploitation is possible: Serialized PHP objects are reconstructed without validation or a class allowlist, allowing magic methods and available gadget chains to be invoked during deserialization
Why this happens
The underlying bug is the use of PHP's generic unserialize() function on data controlled by a client. PHP object reconstruction can invoke class-specific magic methods and restore object graphs with attacker-selected properties, turning data parsing into executable behavior. This maps to CWE-502: Deserialization of Untrusted Data because serialized input is trusted without restricting classes, validating structure, or separating data representation from executable object behavior.
Potential impact
- An attacker may execute arbitrary code in the web application process
- The application and its stored data could be compromised
- Credentials, configuration values, or other sensitive information may be exposed
- The server could be used for persistence, lateral movement, or additional attacks
- Content and application behavior could be modified or corrupted
General mitigation guidance
Mitigation generally focuses on removing unsafe object deserialization from attacker-controlled request paths and reducing the trust placed in client-side state.
Common defensive patterns include:
- Replacing PHP object serialization with a data-only format and strict schema validation
- Avoiding
unserialize()for untrusted input; where legacy compatibility is unavoidable, enforcing a narrowly defined class allowlist and rejecting unexpected structures - Storing session or user-state data server-side, using opaque integrity-protected identifiers in cookies
- Restricting application and PHP process privileges according to least-privilege principles
- Limiting unnecessary extensions and gadget-producing components in production runtimes
- Applying defense-in-depth controls such as request validation, isolation, and egress restrictions
How teams detect issues like this
High-level detection can include:
- Static analysis rules identifying
unserialize()calls whose input originates from cookies, request parameters, headers, or other external sources - Code review checks for missing class allowlists, integrity validation, or schema enforcement around serialized data
- Runtime monitoring for suspicious cookie values, deserialization warnings, unexpected magic-method activity, and anomalous child-process execution
- Policy enforcement that prohibits native object deserialization on untrusted input paths
- Automated security review tools configured to trace user-controlled data into deserialization sinks
