CVE-2023-33177

This script generates a malicious ZIP file exploiting a path traversal vulnerability (Zip Slip) in Xibo CMS's layout import functionality, allowing authenticated attackers to achieve remote code execution via a PHP webshell.

This repository contains a functional Python-based exploit for CVE-2023-33177, a Zip Slip path traversal vulnerability in Xibo CMS that leads to Remote Code Execution (RCE). The exploit automates authentication, payload generation, and vulnerability verification by attempting to write a test file to the server.

This exploit demonstrates a path traversal vulnerability (Zip Slip) in Xibo CMS, allowing remote code execution via malicious layout imports. It generates a ZIP file with a traversal payload in `mapping.json` to write a PHP webshell to the web root.