Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2024-23724 PoC — Ghost 跨站脚本漏洞

Source
Associated Vulnerability
Title:Ghost 跨站脚本漏洞 (CVE-2024-23724)
Description:Ghost CMS是新加坡Ghost基金会的一套使用JavaScript编写的开源无头内容管理系统(CMS)。 Ghost 5.76.0及之前版本存在跨站脚本漏洞,该漏洞源于攻击者可以通过包含 JavaScript 代码的 SVG 个人资料图片接管任何帐户,与本地主机 TCP 端口 3001 上的 API 进行交互。
Description
Ghost-CMS Exploit is python script. This script first performs brute-force authentication attempts using the provided wordlists. If valid credentials are found, it proceeds to check for CVE-2024-23724 vulnerability and generates an exploit payload if vulnerable.
Readme
# Ghost-CMS-Exploit
Ghost-CMS Exploit is python script. This script first performs brute-force authentication attempts using the provided wordlists. If valid credentials are found, it proceeds to check for CVE-2024-23724 vulnerability and generates an exploit payload if vulnerable.

**Requirements:**
1. Python 3.x installed
2. Install required library: `pip install requests`
3. A `boilerplate.svg` file in the same directory (used for generating the exploit payload)
4. Wordlist files for usernames and passwords

**Usage:**
```bash
python3 ghost-cms.py -U userlist.txt -P passlist.txt -t http://target-domain
```

**Features:**
1. Brute-force attack with progress reporting
2. Session management for successful logins
3. Automatic CVE-2024-23724 vulnerability check
4. SVG payload generation for confirmed vulnerabilities
5. Timeout handling for network requests
6. Error handling for file operations and network issues

**Note:**
- The target URL should be provided without the port (e.g., http://localhost)
- The script assumes Ghost CMS is running on port 3001
- Wordlist files should contain one credential per line
- The boilerplate.svg file should contain the appropriate placeholders used in the original script
File Snapshot

[4.0K] /data/pocs/553c4dea1a027589990c9a15439235db6227e0b8 ├── [3.2K] boilerplate.svg ├── [5.7K] ghost-cms.py └── [1.2K] README.md 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.