Exploit for CVE-2017-12636

kitploit · 2026-08-27

Description

Arbitrary command execution in CouchDB via the tools component.

Entry point

Parameterecho '#{@cmdstager}' > #{rand_file} · request body

Path/_config/query_servers/#{rand_cmd1}

CouchDB arbitrary command execution via config query_servers path (PUT)

Affected Apache Couchdb versions

Apache Couchdb< 1.7.0, 2.0.0

All known vulnerabilities by product

CVSS 9.0 for CVE-2017-12636

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:HIGH

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-08-27 14:30

Last Seen:2026-08-27 20:22

Reporter:KitPloit

Tags

CouchDBcommand executiontoolsarbitrary executionCVE-2017-12636

Other exploits for CVE-2017-12636

2026-08-28 KitPloitKITPLOIT

couchdb-exploit

2026-08-23 KitPloitKITPLOIT

Exploit for Improper Privilege Management in Apache Couchdb

2026-08-03 DarabiumGITHUB

Exploit for Improper Privilege Management in Apache Couchdb

2026-08-03 DarabiumGITHUB

Exploit for Improper Privilege Management in Apache Couchdb

2026-05-29 DungsocoolGITHUB

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

2021-10-22 王先生GITEE

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

2021-05-16 nullGITEE

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

2021-04-27 嗯个GITEE

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-MOAYADALMALAT-CVE-2017-12636
# Уязвимость произвольного выполнения команд в Couchdb (CVE-2017-12636)