POC详情: 5ea1d6fb68df32c63b09a02234a6db715ae2e32b

来源
关联漏洞
标题: Ghost Foundation Ghost 后置链接漏洞 (CVE-2023-40028)
描述:Ghost Foundation Ghost是Ghost开源的一款用 JavaScript 编写的个人博客系统。 Ghost 5.59.1 版本之前存在后置链接漏洞,该漏洞源于允许经过身份验证的用户上传符号链接文件。攻击者利用该漏洞可以读取任意文件。
介绍
# Proof of Concept (PoC) for CVE-2023-40028

CVE-2023-40028 is a **vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling.** This PoC demonstrates how the exploit works under controlled conditions. **Educational use only.**

**Reference:** Adapted from the original PoC by [0xyassine](https://github.com/0xyassine/CVE-2023-40028), rewritten in Python and applied to the HackTheBox challenge "LinkVortex."

### Summary:

1. **Vulnerability:** Arbitrary file read in Ghost CMS.
2. **Impact:** Access to sensitive files on the server.
3. **Fix:** Update to the latest Ghost CMS version.

**Usage:**
```
python3 ./CVE-2023-40028.py --url <http://abc.xyz> -u <username> -p <password>
```

**Use this information responsibly. Unauthorized exploitation is illegal.**

文件快照

[4.0K] /data/pocs/5ea1d6fb68df32c63b09a02234a6db715ae2e32b ├── [3.7K] CVE-2023-40028.py └── [ 797] README.md 0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。