Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-33177— Xibo CMS vulnerable to Remote Code Execution through Zip Slip

Quick assessment

Affected
xibosignage xibo-cms
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Xibo是Xibo Digital Signage开源的一个内容管理系统。 Xibo 存在安全漏洞，该漏洞源于存在路径遍历漏洞，经过身份验证的用户可以将特制的zip文件上传到CMS，这将允许作为网络服务器用户在CMS库目录之外创建文件。

CVSS 8.8 · High EPSS 7.04% · P94

Public Exploits 1

ExploitDB · 1 EDB-52500 [webapps]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-33177

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Source: CVE Program / CVE List V5
Vulnerability Description
Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Xibo 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xibo是Xibo Digital Signage开源的一个内容管理系统。 Xibo 存在安全漏洞，该漏洞源于存在路径遍历漏洞，经过身份验证的用户可以将特制的zip文件上传到CMS，这将允许作为网络服务器用户在CMS库目录之外创建文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
xibosignage xibo-cms >= 1.8.0, < 2.3.17 -

II. Public POCs for CVE-2023-33177

# POC Description Source Link Shenlong Link
1 This exploit demonstrates a **path traversal vulnerability** in Xibo CMS (CVE-2023-33177) that allows remote code execution through malicious layout imports. https://github.com/complexusprada/Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-33177

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-33177 (2)

Vendor Advisories for CVE-2023-33177 (1)

Security Blog Posts for CVE-2023-33177 (1)

Other References for CVE-2023-33177 (1)

Same Patch Batch · xibosignage · 2023-05-30 · 5 CVEs total

CVE-2023-33180 6.5 MEDIUM Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map
CVE-2023-33179 6.5 MEDIUM Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter
CVE-2023-33178 6.5 MEDIUM Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
CVE-2023-33181 4.3 MEDIUM Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

IV. Related Vulnerabilities

Same product: xibo-cms
Same vendor: xibosignage
Same weakness: CWE-22

V. Comments for CVE-2023-33177

No comments yet

Leave a comment