MaxSite CMS Admin Session Cookie Forgery

MaxSite CMS versions up to 109.6 are affected by a hardcoded session encryption key in application/config/config.php.

This key is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies.

Attackers can compute an HMAC-SHA1 using the publicly known encryption key to create a malicious ci_session cookie with administrator privileges, bypassing authentication checks.