PT-2025-23446 · Unknown · Juzawebcms

Cyber-Wo0Dy · Published 2025-06-02 · Updated 2025-06-02 · CVE-2025-5423

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions juzaweb CMS versions up to 3.4.2

Description A critical vulnerability has been found in the General Setting Page component of juzaweb CMS, affecting unknown code of the file /admin-cp/setting/system/general. This vulnerability leads to improper access controls and can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For juzaweb CMS versions up to 3.4.2, as a temporary workaround, consider restricting access to the /admin-cp/setting/system/general file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-5423

Affected Products

Juzawebcms

References · 8

• 🔥 https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_access_modify_general_settings.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5423 · Security Note
• https://t.me/cvenotify/124286 · Telegram Post
• https://vuldb.com/?ctiid.310756 · Note
• https://vuldb.com/?id.310756 · Note
• https://vuldb.com/?submit.584051 · Note
• https://t.me/cvetracker/25118 · Telegram Post