Juzaweb Juzaweb CMS Broken Access Control Vulnerability in General Settings Page

A critical broken access control vulnerability has been identified in Juzaweb CMS versions through 3.4.2. This issue allows non-privileged users to view and modify CMS configuration settings. The vulnerability is present in the General Setting Page of the admin control panel, specifically within the system settings.

Impact

Exploitation of this vulnerability enables low-privileged users to access and alter CMS configuration information, potentially leading to unauthorized changes in the application's behavior or settings.

Reproduction

To reproduce this vulnerability, create a new user and assign it to a role with all permissions disabled. After logging in with this account, navigate to the General Setting Page in the admin control panel. The user will be able to view and edit various fields related to the general CMS settings.