Listen to this Post
The vulnerability is a SQL injection flaw in the `/ghost/api/admin/members/events` Admin API endpoint of Ghost. It allows authenticated users with Admin API credentials to execute arbitrary SQL commands. The issue stems from improper neutralization of special elements used in an SQL command within the endpoint’s filtering or query parameters. User-supplied input in request parameters is concatenated directly into an SQL query without adequate sanitization or the use of parameterized queries. An attacker can craft malicious input containing SQL meta-characters (like quotes or semicolons) to break out of the intended query structure. This manipulated input is then passed to the database layer for execution. For example, a specially crafted `filter` parameter in a GET request could modify the `WHERE` clause of the SQL statement. The vulnerability permits reading, updating, or deleting data from the application’s database. It could lead to full compromise of the database backend, including exposure of member data, admin credentials, or site content. The attack requires a valid Admin API key, limiting immediate external exploitation but posing a significant insider or post-compromise threat.
Platform: Ghost CMS
Version: 5.90.0-5.130.5, 6.0.0-6.10.3
Vulnerability : SQL Injection
Severity: Moderate
date: 2026-01-08
Prediction: 2026-01-08
What Undercode Say:
curl -H "Authorization: Ghost <api_key>" "https://<ghost-site>/ghost/api/admin/members/events?filter=id%3D1%20OR%201%3D1--"
grep -r "knex.raw" services/members/
npm list ghost
How Exploit:
Craft a malicious HTTP request to the `/ghost/api/admin/members/events` endpoint with a crafted `filter` parameter containing SQL payloads, using a valid Admin API key for authentication.
Protection from this CVE
Update to Ghost v5.130.6 or v6.11.0. Implement strict input validation and use parameterized queries for all database operations. Restrict Admin API key access and permissions.
Impact:
Unauthorized database access, data breach of member information, potential full system compromise, and integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
