Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
The vulnerability classified as CWE-89 (SQL injection) allows an attacker to inject malicious SQL queries into the Ghost application's database without needing to possess any account or session. An attacker can send crafted requests directly to a Ghost instance and read any data stored in the database. The lack of an authentication mechanism as a prerequisite (Auth Bypass) makes the attack possible to perform remotely over the network with low complexity.
An attacker can gain unauthorized access to sensitive data stored in the database, such as user data, session tokens, or unpublished content, and potentially modify data in the database, which constitutes a serious breach of system confidentiality and integrity.
Ghost should be updated to version 6.19.1 or later, in which the vulnerability has been fixed. A patch is available in the vendor's repository (GitHub TryGhost/Ghost, release v6.19.1).
Ghost (Node.js CMS) in versions from 3.24.0 to 6.19.0 inclusive.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LGhost
APPGhost3.24.0 – 6.19.1 (excl.)
Related vulnerabilities
Ghost CMS – obejście limitu prób uwierzytelnienia przez nagłówki X-Forwarded-For
Ghost CMS: stored XSS w pliku SVG umożliwia privilege escalation
Ghost CMS: Arbitrary File Upload umożliwiający wykonanie kodu (RCE)
Ghost v4.39.0 — przesyłanie plików SVG z potencjalnym wykonaniem kodu po stronie klienta
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections arou...