Juzaweb CMS Improper Authorization Vulnerability in Theme Installation Component

A critical vulnerability exists in Juzaweb CMS version 3.4.2, specifically within the 'Add New Themes' page in the admin control panel. The issue arises from improper authorization, allowing unprivileged users to upload arbitrary themes to the CMS. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability enables users with limited privileges to import and potentially execute malicious themes within the CMS.

Reproduction

To reproduce this vulnerability, create a new user account and assign it a role with all permissions disabled. Log in with this account and navigate to the 'Add New Themes' page in the admin control panel. Despite the restricted permissions, the user will be able to upload new themes to the CMS.