CVE-2025-12347
📋 TL;DR
This vulnerability in MaxSite CMS allows remote attackers to upload arbitrary files without proper restrictions. It affects MaxSite CMS versions up to 109 through manipulation of file upload parameters in the admin plugins editor. Attackers can exploit this to upload malicious files to vulnerable systems.
💻 Affected Systems
- MaxSite CMS
📦 What is this software?
Maxsite Cms by Max 3000
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Webshell upload enabling persistent backdoor access and further system exploitation.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Exploit details published online; requires admin access or ability to reach vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to version 110+ if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict access to vulnerable endpoint
allBlock or restrict access to /application/maxsite/admin/plugins/editor_files/save-file-ajax.php
# Apache: RewriteRule ^application/maxsite/admin/plugins/editor_files/save-file-ajax\.php$ - [F]
# Nginx: location ~ /application/maxsite/admin/plugins/editor_files/save-file-ajax\.php { deny all; }
Implement file upload validation
allAdd server-side validation for file uploads including file type checking and size limits
# Add to save-file-ajax.php: $allowed_types = ['jpg', 'png', 'gif']; $max_size = 5242880;
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file upload exploits
- Disable the plugins editor functionality entirely if not needed
🔍 How to Verify
Check if Vulnerable:
Check if MaxSite CMS version is ≤109 and if /application/maxsite/admin/plugins/editor_files/save-file-ajax.php exists and is accessible.Check Version:
Check MaxSite CMS configuration files or admin panel for version information.Verify Fix Applied:
Test file upload functionality with malicious files; successful upload indicates vulnerability.📡 Detection & Monitoring
Log Indicators:
- POST requests to save-file-ajax.php with unusual file extensions
- File uploads with executable extensions (.php, .exe, .sh)
Network Indicators:
- Unusual file upload traffic to admin plugins endpoint
- POST requests with file upload parameters
SIEM Query:
source="web_logs" AND uri="/application/maxsite/admin/plugins/editor_files/save-file-ajax.php" AND (method="POST" OR file_extension IN ("php", "exe", "sh"))