MaxSite CMS Post-Install Configuration Injection RCE

Technical Analysis

CVE-2026-70553 (CVSS 9.8) exploits improper input sanitization in MaxSite CMS's install endpoint, which remains reachable even after installation is marked complete. By submitting a crafted POST request with a malicious db_dbprefix parameter containing a single quote, an attacker can break out of a PHP string literal in application/config/database.php and append arbitrary PHP statements. These injected statements are persisted to disk and executed on every subsequent request, granting durable unauthenticated code execution as the web-server user. This is a classic config-file injection pattern common in PHP CMS installers that fail to validate or escape user-supplied values before writing them to executable configuration files. If MaxSite CMS or similarly architected PHP applications are used as backends for RAG document stores, agent orchestration dashboards, or internal tooling accessible to AI agents, successful exploitation could allow attackers to pivot into agent infrastructure, exfiltrate API keys/secrets stored in environment or config files, or manipulate data the agent ingests — warranting agent-relevant risk classification for organizations with such deployments.

Affected Systems

MaxSite CMS (all versions exposing the install endpoint post-installation); PHP-based web servers running application/config/database.php with unrestricted access to the install script

Indicators of Compromise

• POST requests to /install/ or /installer/ endpoint with db_dbprefix parameter containing single-quote characters
• Modified application/config/database.php with anomalous PHP code appended after expected array/string values
• Unexpected outbound connections or webshell activity originating from CMS web root

Remediation Steps

1. 1

   Remove or restrict install endpoint

   Delete or block access to the installer directory/script immediately after initial setup completes; restrict via web server rules (e.g., deny all in .htaccess/nginx config).

2. 2

   Patch or upgrade MaxSite CMS

   Apply vendor patches once available, or upgrade to a version that sanitizes install-time input and disables the installer post-setup.

3. 3

   Audit configuration files

   Inspect application/config/database.php and related config files for injected PHP code or unexpected statements; restore from known-good backups if compromise is confirmed.

4. 4

   Rotate credentials and secrets

   Rotate database credentials, API keys, and any secrets stored in or near the compromised configuration files, especially if agent systems reference the same environment.

5. 5

   Implement WAF rules

   Deploy web application firewall rules to detect and block single-quote injection patterns targeting installer endpoints.

6. 6

   Monitor for persistence

   Check for webshells, scheduled tasks, or additional backdoors dropped via the initial RCE foothold.