Ghost-CMS-Exploit

Ghost-CMS-Exploit Ghost-CMS Exploit은 Python 스크립트입니다. 이 스크립트는 먼저 제공된 워드리스트를 사용하여 무차별 대입 인증 시도를 수행합니다. 유효한 자격 증명이 발견되면 CVE-2024-23724 취약점을 확인하고, 취약한 경우 익스플로잇 페이로드를 생성합니다. 요구 사항: 1. Python 3.x 설치 2. 필수 라이브러리 설치: pip install requests 3. 같은 디렉토리에 boilerplate.svg 파일이 있어야 함 익스플로잇 페이로드 생성에 사용 4. 사용자 이름과...

CVE-2024-23724

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...

CVE-2024-23724: Ghost CMS Stored XSS Leading to Owner Takeover

The post CVE-2024-23724: Ghost CMS Stored XSS Leading to Owner Takeover appeared first on Rhino Security Labs...

CVE-2024-23724

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...

CVE-2024-23724

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...

CVE-2024-23724

Ghost CMS up to version 5.76.0 is vulnerable to a stored XSS via an SVG profile image containing JavaScript that can interact with the API on localhost:3001, potentially leading to privilege escalation where a contributor can take over any account. The issue is repeatedly described across multipl...