{"uuid": "542cf335-38dc-4fa0-bff8-cf6345c58552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34104", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"FireFart\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module will generate a plugin, pack the payload into it\\n          and upload it to a server running Piwik. Superuser Credentials are\\n          required to run this module. This module does not work against Piwik 1\\n          as there is no option to upload custom plugins. Piwik disabled\\n          custom plugin uploads in version 3.0.3. From version 3.0.3 onwards you\\n          have to enable custom plugin uploads via the config file.\\n          Tested with Piwik 2.14.0, 2.16.0, 2.17.1 and 3.0.1.\", \"disclosure_date\": \"2017-02-05\", \"fullname\": \"exploit/unix/webapp/piwik_superuser_plugin_upload\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"Piwik Superuser Plugin Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/webapp/piwik_superuser_plugin_upload\", \"references\": [\"CVE-2025-34104\", \"URL-https://firefart.at/post/turning_piwik_superuser_creds_into_rce/\", \"URL-https://piwik.org/faq/plugins/faq_21/\", \"URL-https://piwik.org/changelog/piwik-3-0-3/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Piwik\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:46.650663Z"}