Impact
Ghost versions 3.24.0 through 6.19.0 are susceptible to a critical SQL injection vulnerability in the Content API [S1]. An unauthenticated attacker can exploit this flaw to execute arbitrary SQL commands against the underlying database [S2]. Successful exploitation could result in the exposure of sensitive user data or unauthorized modification of site content [S3]. This vulnerability has been assigned a CVSS score of 9.4, reflecting its critical severity [S2].
Root Cause
The issue stems from improper input validation within the Ghost Content API [S1]. Specifically, the application fails to correctly sanitize user-supplied data before incorporating it into SQL queries [S2]. This allows an attacker to manipulate the query structure by injecting malicious SQL fragments [S3].
Affected Versions
Ghost versions starting from 3.24.0 up to and including 6.19.0 are vulnerable to this issue [S1][S2].
Remediation
Administrators should upgrade their Ghost installation to version 6.19.1 or later to resolve this vulnerability [S1]. This version includes patches that properly neutralize input used in Content API queries [S3].
Vulnerability Identification
Identification of this vulnerability involves verifying the installed version of the ghost package against the affected range (3.24.0 to 6.19.0) [S1]. Systems running these versions are considered at high risk for SQL injection via the Content API [S2].