CVE-2022-47197
Possible ATT&CK Techniques 3AI
T1133 · External Remote Services T1059.007 · JavaScript T1505.003 · Web ShellGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-47197
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的缺省变量初始化
Source: CVE Program / CVE List V5
Vulnerability Title
Ghost Foundation Ghost 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ghost Foundation Ghost是Ghost开源的一款用 JavaScript 编写的个人博客系统。 Ghost Foundation Ghost 5.9.4版本存在跨站脚本漏洞。攻击者利用该漏洞发送HTTP请求，在帖子中注入Javascript，以诱骗管理员访问帖子。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ghost Foundation | Ghost | 5.9.4 | - |
II. Public POCs for CVE-2022-47197
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/miguelc49/CVE-2022-47197-2 | POC Details |
| 2 | None | https://github.com/miguelc49/CVE-2022-47197-1 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-47197
请登录查看更多情报信息。
Other References for CVE-2022-47197 (1)
Same Patch Batch · Ghost Foundation · 2023-01-19 · 4 CVEs total
| CVE-2022-47194 | Ghost Foundation Ghost 安全漏洞 | |
| CVE-2022-47195 | Ghost Foundation Ghost 跨站脚本漏洞 | |
| CVE-2022-47196 | Ghost Foundation Ghost 安全漏洞 |
IV. Related Vulnerabilities
Same product: Ghost
Same weakness: CWE-453
- CVE-2026-41330
OpenClaw < 2026.3.31 - Environment Variable Override via Hos - CVE-2025-61926
Allstar Reviewbot has Authentication Bypass via Hard-coded W - CVE-2025-47945
Donetick Has Weak Default JWT Secret - CVE-2024-49120
Windows Remote Desktop Services Remote Code Execution Vulner - CVE-2024-39916
NFS server misconfiguration allows file access outside the e
V. Comments for CVE-2022-47197
No comments yet