Thank you for your reply. Now, let me ask one more question. Is it possible to evaluate the effectiveness of your proposal on Ghost CMS having No.1 vulnerability? I think a vulnerable Ghost CMS could be obtained by the following URL. https://github.com/TryGhost/Ghost/releases?page=7
Thanks for your questions.
Our proposed method can detect the vulnerability of Ghost CMS.
In fact, we have conducted an evaluation experiment using Ghost CMS and succeeded in detecting the vulnerability.
Please refer to the following document which describes the results of our proposed method for detecting Ghost vulnerability.
Toru Taya, Masaki Hanada, Yoichi Murakamii, Atsushi Waseda, Yuki Ishida, Takao Mimura, Moo Wan KIM, Eiji Nunohiro, ``WebAPI Vulnerability Assessment Tool Based on Request and Response Sequences'', The 27th International Symposium on Artificial Life and Robotics (AROB 2022).
As you know the vulnerable version of Ghost CMS can be downloaded from that URL.
