CVE-2024-23724 PoC — Ghost 跨站脚本漏洞

Description

Ghost-CMS Exploit is python script. This script first performs brute-force authentication attempts using the provided wordlists. If valid credentials are found, it proceeds to check for CVE-2024-23724 vulnerability and generates an exploit payload if vulnerable.

Readme

# Ghost-CMS-Exploit
Ghost-CMS Exploit is python script. This script first performs brute-force authentication attempts using the provided wordlists. If valid credentials are found, it proceeds to check for CVE-2024-23724 vulnerability and generates an exploit payload if vulnerable.

**Requirements:**
1. Python 3.x installed
2. Install required library: `pip install requests`
3. A `boilerplate.svg` file in the same directory (used for generating the exploit payload)
4. Wordlist files for usernames and passwords

**Usage:**
```bash
python3 ghost-cms.py -U userlist.txt -P passlist.txt -t http://target-domain
```

**Features:**
1. Brute-force attack with progress reporting
2. Session management for successful logins
3. Automatic CVE-2024-23724 vulnerability check
4. SVG payload generation for confirmed vulnerabilities
5. Timeout handling for network requests
6. Error handling for file operations and network issues

**Note:**
- The target URL should be provided without the port (e.g., http://localhost)
- The script assumes Ghost CMS is running on port 3001
- Wordlist files should contain one credential per line
- The boilerplate.svg file should contain the appropriate placeholders used in the original script

File Snapshot

Remarks