MaxSite CMS CVE-2025-12347

Exploitation requires valid authentication credentials for the MaxSite CMS admin panel (PR:L per CVSS vector). The attacker must have network access to the admin plugin endpoint at application/maxsite/admin/plugins/editor_files/save-file-ajax.php. No special configuration or non-default settings are required - the vulnerable code path exists in the standard plugin installation. The vulnerability is limited to authenticated users; unauthenticated remote exploitation is not possible due to the admin panel access requirement. The scope of impact is limited to the authenticated user's privilege level, preventing full system compromise but allowing file upload and potential remote code execution within web server permissions.

Despite the low CVSS score of 2.1, this vulnerability presents moderate practical risk in certain deployments. The CVSS vector indicates network accessibility (AV:N), low complexity (AC:L), and requires authenticated access (PR:L), which limits opportunistic exploitation to users with valid credentials. The EPSS score of 0.05% (16th percentile) reflects low probability of widespread automated exploitation, consistent with the authentication requirement. However, the presence of publicly available exploit code (E:P flag) increases risk for organizations with weak credential management or where admin-level users are compromised. The combination of authentication requirement and low EPSS suggests this is not a high-priority vulnerability for most organizations unless they operate in high-threat environments with credential compromise risk. The vendor's non-responsiveness to disclosure means no official patch exists, making this a lower-urgency but still exploitable flaw that depends on access controls and admin account security.

An authenticated user with admin panel access obtains valid credentials through phishing or insider access. They navigate to or send a crafted POST request to the save-file-ajax.php endpoint with malicious file_path and content parameters, specifying a PHP webshell or other executable file for upload. The insufficient access control validation allows the file to be written to a web-accessible directory, granting the attacker ability to execute arbitrary code on the server or escalate privileges.