Technical impact
The vulnerability centers on an unsafe call to PHP’s unserialize function with data directly extracted from a maxsite_comuser cookie. Because the input is not validated or constrained to a whitelist of classes, an attacker can supply a specially crafted serialized payload that triggers PHP magic methods during object reconstruction. The payload can invoke methods from available gadget chains, notably those associated with SoapClient or Imagick extensions, to run arbitrary code on the server. This flaw is categorized as CWE-502 and results in remote code execution even when the attacker has no authentication credentials.
Affected Systems
The issue affects installations of MaxSite CMS. No specific version range was provided in the advisory, so all releases that still use the unfiltered unserialize logic are potentially vulnerable. Administrators should verify the version of MaxSite CMS deployed and compare it against any official update or security notice that addresses this object injection flaw.
Risk and Exploitability
The CVSS score of 9.3 indicates a high severity, while the absence of an EPSS score indicates that current data does not quantify exploitation likelihood. Because the vector is unauthenticated and works via a single HTTP cookie, the vulnerability is exploitable by anyone able to send a crafted request to the vulnerable site. The lack of a KEV listing suggests no widely known active exploits have been reported, but the rest of the evidence implies a serious, one‑click exploitation pathway. Based on the description, the likely attack vector is an unauthenticated HTTP request that sets the maxsite_comuser cookie, which is then passed to unserialize.
