CVE-2023-40028 PoC — Arbitrary file read via symlinks in Ghost

Source

Associated Vulnerability

Readme

# CVE-2023-40028 Exploit

This script exploits a vulnerability in Ghost CMS, allowing arbitrary file read through symbolic link abuse.

# Features

- Creates a symlink to the target file
- Compresses the payload into a ZIP file
- Uploads the ZIP file via the Ghost API
- Reads the file through an accessible image URL
- Cleans up after execution

# Usage

```python3 exploit.py -u <username> -p <password>```

Once the shell starts, enter the full file path you want to read (without spaces) and hit enter.
To exit, type exit.

# Requirements

Python 3.x
`requests` module

# Disclaimer

This script is for educational and authorized security research purposes only. Do not use it on systems you do not own or have explicit permission to test.

# License

This project is licensed under the MIT License - see the LICENSE file for details.

File Snapshot

 [4.0K]  /data/pocs/e592812a4dafb7485977abeefc13dc747f95f8b1
├── [3.4K]  exploit.py
├── [1.0K]  LICENSE
└── [ 839]  README.md

0 directories, 3 files

Remarks