Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-23724 PoC — Ghost 跨站脚本漏洞

Source
https://github.com/Youssefdds/CVE-2024-23724
Associated Vulnerability
Title:Ghost 跨站脚本漏洞 (CVE-2024-23724)
Description:Ghost CMS是新加坡Ghost基金会的一套使用JavaScript编写的开源无头内容管理系统（CMS）。 Ghost 5.76.0及之前版本存在跨站脚本漏洞，该漏洞源于攻击者可以通过包含 JavaScript 代码的 SVG 个人资料图片接管任何帐户，与本地主机 TCP 端口 3001 上的 API 进行交互。
File Snapshot

 [4.0K]  /data/pocs/98233ebb0e8f78a4b433689d77d6a3cba5a78558
├── [ 43K]  boilerplate.svg
├── [ 352]  config.development.json
├── [640K]  CVE_2024_23724.pdf
├── [ 19M]  cve-web-demo.webm
├── [ 997]  docker-compose.yaml
├── [1.5K]  Evaluation_template.md
├── [4.5K]  generate-malicious-svg.py
├── [4.0K]  init_db
│   ├── [ 185]  Dockerfile
│   ├── [ 349]  init_db.sh
│   └── [209K]  mysql_dump.sql
├── [4.0K]  manual-setup
│   ├── [ 637]  config.example.json
│   └── [ 801]  docker-compose.yaml
├── [6.7K]  readme.md
├── [ 249]  setup-script.sh
├── [ 391]  simple-malicious.svg
└── [3.3K]  tenant-takeover.svg

2 directories, 16 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.