mirror of
https://github.com/0xMarcio/cve.git
synced 2025-05-06 10:41:43 +00:00
57 lines
2.5 KiB
Markdown
57 lines
2.5 KiB
Markdown
|
### [CVE-2017-5487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5487)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- https://wpvulndb.com/vulnerabilities/8715
|
||
|
|
- https://www.exploit-db.com/exploits/41497/
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/0v3rride/Week-7
|
||
|
|
- https://github.com/0xPugal/One-Liners
|
||
|
|
- https://github.com/0xPugazh/One-Liners
|
||
|
|
- https://github.com/20142995/sectool
|
||
|
|
- https://github.com/AAp04/Codepath-Week-7
|
||
|
|
- https://github.com/AAp04/WordPress-Pen-Testing
|
||
|
|
- https://github.com/ARPSyndicate/cvemon
|
||
|
|
- https://github.com/ARPSyndicate/kenzer-templates
|
||
|
|
- https://github.com/DannyLi804/CodePath-Pentesting
|
||
|
|
- https://github.com/GeunSam2/CVE-2017-5487
|
||
|
|
- https://github.com/K3ysTr0K3R/CVE-2017-5487-EXPLOIT
|
||
|
|
- https://github.com/K3ysTr0K3R/K3ysTr0K3R
|
||
|
|
- https://github.com/LeakIX/l9explore
|
||
|
|
- https://github.com/LeakIX/l9plugins
|
||
|
|
- https://github.com/MRKWP/mrkwp-rest-permissions
|
||
|
|
- https://github.com/PatyRey/Codepath-WordPress-Pentesting
|
||
|
|
- https://github.com/Polem4rch/Brutepress
|
||
|
|
- https://github.com/R3K1NG/wpUsersScan
|
||
|
|
- https://github.com/Ravindu-Priyankara/CVE-2017-5487-vulnerability-on-NSBM
|
||
|
|
- https://github.com/SeasonLeague/CVE-2017-5487
|
||
|
|
- https://github.com/Sechunt3r/wpenum
|
||
|
|
- https://github.com/Tamie13/Red-Team-Summary-of-Operations
|
||
|
|
- https://github.com/WangYihang/Exploit-Framework
|
||
|
|
- https://github.com/anx0ing/Wordpress_Brute
|
||
|
|
- https://github.com/bensonmacharia/Pentest-Scripts
|
||
|
|
- https://github.com/bhavesh-pardhi/One-Liner
|
||
|
|
- https://github.com/d4n-sec/d4n-sec.github.io
|
||
|
|
- https://github.com/fortify24x7/wpUsersScan
|
||
|
|
- https://github.com/gboddin/l9-nuclei-plugin
|
||
|
|
- https://github.com/htrgouvea/spellbook
|
||
|
|
- https://github.com/justinw238/codepath_7_jlw15
|
||
|
|
- https://github.com/kr4dd/CVE-2017-5487
|
||
|
|
- https://github.com/largewaste/cqr
|
||
|
|
- https://github.com/natlarks/Week7-WordPressPentesting
|
||
|
|
- https://github.com/patilkr/wp-CVE-2017-5487-exploit
|
||
|
|
- https://github.com/ryanfantus/codepath-week-7
|
||
|
|
- https://github.com/teambugsbunny/wpUsersScan
|
||
|
|
- https://github.com/uoanlab/vultest
|
||
|
|
- https://github.com/zkhalidul/GrabberWP-CVE-2017-5487
|
||
|
|
|