MAXcms contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the 'classes/class.Tree.php' script not properly sanitizing user input supplied to the 'GLOBALS[thCMS_root]' parameter. This may allow an attacker to include a file from an arbitrary remote host that contains commands which will be executed by the vulnerable script with the same privileges as the web server.

Upgrade to version 3.16.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2009-3424 (see also: NVD)
• Secunia Advisory ID: 36105
• Related OSVDB ID: 57068 57069 57070 57071 57072 57073 57074 57075 57076 57077 57078 57079 57080 57081 57082 57083 57084 57085 57086 57087 57088 57089 57090 57091 57092 57093 57094 57095 57096 57097 57098 57099 57101
• Milw0rm: 9322
• Exploit Database: 9322
• Vendor URL: http://www.databay.de
• Other Advisory URL: http://www.vupen.com/english/advisories/2009/2136

• NoGe