MaxSite CMS includes a remote code execution flaw that permits an attacker to inject arbitrary PHP code into the application configuration file. By crafting a POST request to the install endpoint after the software is installed, an unauthenticated user can supply a malicious db_dbprefix value containing a single quote that breaks out of a PHP string in application/config/database.php. The injected PHP code is then executed by the web server on every subsequent request, giving persistent, unauthenticated control as the web‑server process user.

The vulnerability affects MaxSite CMS distributed by MaxSite. No specific version range is listed, so any deployed instance of this CMS could be vulnerable until an update is applied.

The CVSS score of 9.3 indicates a critical severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The attack does not require authentication or privileged access; an unauthenticated attacker can reach the vulnerable install endpoint directly after installation, making exploitation straightforward once the endpoint remains active.