CVE-2022-41697 PoC — Ghost CMS 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41697.yaml

Associated Vulnerability

Title:Ghost CMS 安全漏洞 (CVE-2022-41697)
Description:Ghost CMS是新加坡Ghost基金会的一套使用JavaScript编写的开源无头内容管理系统（CMS）。 Ghost CMS 5.9.4版本存在安全漏洞，该漏洞源于登录功能中存在用户枚举漏洞，特别制作的HTTP请求可能会导致敏感信息泄露。

Description

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests.

File Snapshot


 id: CVE-2022-41697

info:
  name: Ghost CMS - User Enumeration
  author: ritikchaddha
  severity: me

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!