Ghost < 5.76.0 - Stored Cross-Site Scripting via SVG Profile Picture
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-23724. PoCs published by gl1tch0x1, Youssefdds.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2024-23724 in Ghost CMS. It performs brute-force authentication followed by SVG payload generation for authenticated users, targeting a specific vulnerability in Ghost CMS.
Description
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
Exploits (2)
This repository contains a functional Python exploit for CVE-2024-23724 in Ghost CMS. It performs brute-force authentication followed by SVG payload generation for authenticated users, targeting a specific vulnerability in Ghost CMS.
This repository contains a functional exploit PoC for CVE-2024-23724, targeting Ghost CMS. The exploit generates a malicious SVG file to achieve tenant takeover by leveraging authentication and role manipulation.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H