CVE-2026-26980 Exploit Metadata

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Go-based exploit for CVE-2026-26980, a SQL injection in Ghost CMS Content API. It performs boolean-based blind SQL injection to extract admin email, password hash, and API secret from the database.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code and README implement a proof-of-concept for CVE-2026-26980, a SQL injection in Ghost CMS. The code performs reconnaissance, setup, authentication, and boolean-blind data extraction against a target URL. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload was observed. The artifact's behavior is consistent with its stated purpose of demonstrating and validating the vulnerability.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesGo

Target softwareGhost CMS

Attack typesSQL Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the SQL injection vulnerability to extract sensitive data (email, password hash, API secret) from the database, not merely detecting or reporting its presence.

ghost_sqli_cms.go:636-658ghost_sqli_cms.go:522-551

Requirements

Target Ghost CMS instance running an affected version (3.24.0 through 6.19.0) with network access.README.md:20-21
A Content API key, either obtained automatically via setup/login or supplied manually.ghost_sqli_cms.go:373-388

Observed behavior

Performs boolean-based blind SQL injection by sending crafted filter parameters to the Content API and observing HTTP status codes (200 for true, 500 for false).ghost_sqli_cms.go:522-551
Extracts data character by character using binary search on ORD/SUBSTR SQL functions.ghost_sqli_cms.go:596-611
Extracts admin email, password hash, and admin API secret from the database.ghost_sqli_cms.go:636-658

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Harvesting: Extracts admin email, bcrypt password hash, and admin API secret from the target database via SQL injection.This is the core exploit behavior described by the CVE and the README. The tool is designed to extract these secrets as proof of vulnerability, not to exfiltrate them to an attacker-controlled third party.ghost_sqli_cms.go:636-658
Target Interaction: Performs Ghost CMS setup and login using hardcoded credentials (admin@ghost-poc.local / Gh0stP0C2026!!) against the target.The tool attempts to set up a fresh Ghost instance or log in if already set up. This is part of the PoC flow to obtain a Content API key needed for the injection. The credentials are hardcoded for the PoC and are not exfiltrated.ghost_sqli_cms.go:293-371
Network Communication: Makes HTTP requests only to the user-supplied --url target.All network calls are directed at the base URL provided by the operator. No external callbacks, C2 channels, or data exfiltration to third-party hosts are present.ghost_sqli_cms.go:188-259

Review boundaries

What the analysis did not establish

Evidence includes only two text files (README.md and ghost_sqli_cms.go); three non-text media files and one unclassified file are present but not analyzed.
The artifact's complete_artifact_coverage is false; the analysis scope is limited to the selected text files.
Three non-text files (images, go.mod, go.sum) and one text file (ghost_sqli/ directory content) were present in the repository but not included in the review packet. Their content was not analyzed.
The review is based solely on static source code analysis; no dynamic execution or behavioral monitoring was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-26980