### [CVE-2017-8295](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8295)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.

### POC

#### Reference
- https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html
- https://wpvulndb.com/vulnerabilities/8807
- https://www.exploit-db.com/exploits/41963/

#### Github
- https://github.com/0v3rride/Week-7
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Afetter618/WordPress-PenTest
- https://github.com/Astrogeorgeonethree/Starred
- https://github.com/Astrogeorgeonethree/Starred2
- https://github.com/Atem1988/Starred
- https://github.com/DynamicDesignz/Alien-Framework
- https://github.com/Elias-Junior/Passo-a-passo-Wordpress
- https://github.com/Gshack18/WPS_Scan
- https://github.com/LeCielBleu/SecurityDocs
- https://github.com/SexyBeast233/SecBooks
- https://github.com/ZTK-009/collection-document
- https://github.com/alash3al/wp-allowed-hosts
- https://github.com/alphaSeclab/sec-daily-2019
- https://github.com/beelzebielsk/csc59938-week-7
- https://github.com/cyberheartmi9/CVE-2017-8295
- https://github.com/harrystaley/CSCI4349_Week9_Honeypot
- https://github.com/harrystaley/TAMUSA_CSCI4349_Week9_Honeypot
- https://github.com/holisticon/hack-yourself
- https://github.com/homjxi0e/CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset
- https://github.com/investlab/Reset-wordpress-pass
- https://github.com/lnick2023/nicenice
- https://github.com/password520/collection-document
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/umarfarook882/WAF-Rule-Writing-part-3
- https://github.com/wisoez/Reset-wordpress-pass
- https://github.com/xbl3/awesome-cve-poc_qazbnm456