Juzaweb CMS Broken Access Control Vulnerability in Plugin Editor Page

A critical vulnerability has been identified in Juzaweb CMS versions through 3.4.2. The issue resides in the Plugin Editor Page component, specifically within the file /admin-cp/plugin/editor. This vulnerability allows improper access controls, enabling unprivileged users to access and edit the code of installed plugins. The exploitation can be performed remotely.

Impact

Exploitation of this vulnerability allows unprivileged users to access and modify the code of plugins installed on the CMS. This could lead to arbitrary code execution.

Reproduction

To reproduce this vulnerability, create a new user and assign it a role with all permissions disabled. Log in with this account and navigate to the admin plugin editor page. The user will be able to access and edit plugin functions, despite having no permissions.