deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Flowise JS Injection RCE
Type: exploit
Path: modules/exploits/multi/http/flowise_js_rce.rb
Platform: %w[unix linux
Disclosure date: 2025-09-13
References: CVE-2025-59528, EDB-52440
Targets: Unix/Linux Command, Windows Command

Description:
This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1
          and < 3.0.6. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP)
          located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts, which allows users to execute
          arbitrary commands via JavaScript code injection in the mcpServerConfig parameter using the
          convertToValidJSONString function that uses Function('return ' + inputString)(). For versions < 3.0.1,
          the exploit can work unauthenticated if FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables
          are not configured. For versions >= 3.0.1, authentication via FLOWISE_EMAIL and FLOWISE_PASSWORD is
          required due to JWT token verification.

Check method (fingerprinting):
version = flowise_get_version
    return CheckCode::Unknown('Could not retrieve Flowise version') unless version

    print_status("Flowise version detected: #{version}")

    # Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.6 (September 12, 2025)
    # Note: Rex::Version parses "2.2.7-patch.1" as "2.2.7.pre.patch.1", so we check >= 2.2.7
    if (version >= Rex::Version.new('2.2.7') || version.to_s.include?('2.2.7')) && version < Rex::Version.new('3.0.6')
      base_msg = '(affected: >= 2.2.7-patch.1 and < 3.0.6)'
      auth_msg = version >= Rex::Version.new('3.0.1') ? ' (auth required)' : ' (may work unauthenticated)'
      return CheckCode::Appears("#{base_msg}#{auth_msg}")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_fma_shortcode_unauth_rce.rb
Platform: php
Disclosure date: 2023-05-31
References: CVE-2023-2068, URL-https://attackerkb.com/topics/JncRCWZ5xm/cve-2023-2068
Targets: PHP, Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
The Wordpress plugin does not adequately prevent uploading files with disallowed MIME types when using the shortcode.
          This leads to RCE in cases where the allowed MIME type list does not include PHP files.
          In the worst case, this is available to unauthenticated users, but is also works in an authenticated configuration.
          File Manager Advanced Shortcode plugin version `2.3.2` and lower are vulnerable.
          To install the Shortcode plugin File Manager Advanced version `5.0.5` or lower is required to keep the configuration
          vulnerable. Any user privileges can exploit this vulnerability which results in access to the underlying operating system
          with the same privileges under which the Wordpress web services run.

Check method (fingerprinting):
return CheckCode::Safe('Server not online or not detected as WordPress.') unless wordpress_and_online?

    check_fma_shortcode_plugin
    return CheckCode::Safe("Could not find fmakey. Shortcode plugin not installed or check your TARGETURI \"#{datastore['TARGETURI']}\" setting.") if @wp_data['fmakey'].nil?

    CheckCode::Appears("fmakey successfully retrieved: #{@wp_data['fmakey']}")
  end
Metasploit Module: Wordpress Drag and Drop Multi File Uploader RCE
Type: exploit
Path: modules/exploits/multi/http/wp_dnd_mul_file_rce.rb
Platform: php
Disclosure date: 2020-05-11
References: EDB-48520, CVE-2020-12800, URL-https://github.com/amartinsec/CVE-2020-12800

Description:
This module exploits a file upload feature of Drag and Drop Multi File
          Upload - Contact Form 7 for versions prior to 1.3.4.  The allowed file
          extension list can be bypassed by appending a %, allowing for php
          shells to be uploaded.
          No authentication is required for exploitation.

Check method (fingerprinting):
begin
      return check_plugin_version_from_readme('drag-and-drop-multiple-file-upload-contact-form-7', '1.3.4', '1')
    rescue ::Rex::ConnectionError
      vprint_error('Could not connect to the web service')
      return CheckCode::Unknown('Could not connect to the target')
    end
    CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: JBoss DeploymentFileRepository WAR Deployment (via JMXInvokerServlet)
Type: exploit
Path: modules/exploits/multi/http/jboss_invoke_deploy.rb
Platform: java
Disclosure date: 2007-02-20
References: CVE-2007-1036, OSVDB-33744, URL-http://www.redteam-pentesting.de/publications/jboss
Targets: Automatic, Java Universal, Windows Universal, Linux x86

Description:
This module can be used to execute a payload on JBoss servers that have an
          exposed HTTPAdaptor's JMX Invoker exposed on the "JMXInvokerServlet". By invoking
          the methods provided by jboss.admin:DeploymentFileRepository a stager is deployed
          to finally upload the selected payload to the target. The DeploymentFileRepository
          methods are only available on Jboss 4.x and 5.x.

Check method (fingerprinting):
res = send_serialized_request('version')
    if res.nil?
      vprint_error('Connection timed out')
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    elsif res.code != 200
      vprint_error("Unable to request version, returned http code is: #{res.code}")
      return Exploit::CheckCode::Unknown("Unexpected HTTP status code: #{res.code}")
    end

    # Check if the version is supported by this exploit
    return Exploit::CheckCode::Appears('The target appears to be a vulnerable version') if res.body =~ /CVSTag=Branch_4_/
    return Exploit::CheckCode::Appears('The target appears to be a vulnerable version') if res.body =~ /SVNTag=JBoss_4_/
    return Exploit::CheckCode::Appears('The target appears to be a vulnerable version') if res.body =~ /SVNTag=JBoss_5_/

    if res.body =~ /ServletException/ # Simple check, if we caused an exception.
      vprint_status('Target seems vulnerable, but the used JBoss version is not supported by this exploit')
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    end

    return Exploit::CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: WordPress StoryChief Plugin Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_story_chef_file_upload.rb
Platform: php
Disclosure date: 2025-08-04
References: CVE-2025-7441, EDB-52422, URL-https://github.com/Story-Chief/wordpress

Description:
This module exploits an unauthenticated arbitrary file upload
          vulnerability in the StoryChief WordPress plugin <= 1.0.42.

          The plugin exposes a webhook endpoint at
          /wp-json/storychief/webhook which accepts a forged HMAC.
          Because the plugin uses an empty secret for HMAC validation,
          attackers can compute a valid MAC and force WordPress to
          download and store attacker-controlled PHP content inside
          the uploads directory, resulting in remote code execution.

Check method (fingerprinting):
return CheckCode::Safe('WordPress not detected') unless wordpress_and_online?

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'wp-json', 'storychief')
    )

    unless res && res.code == 200
      return CheckCode::Safe('StoryChief REST namespace not found')
    end

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'wp-json', 'storychief', 'webhook'),
      'ctype' => 'application/json',
      'data' => '{"meta":{"mac":"","event":"publish"},"data":{}}'
    )

    return CheckCode::Unknown('No response from webhook endpoint') unless res

    return CheckCode::Appears('StoryChief webhook endpoint reachable and likely vulnerable') if res.code != 404

    CheckCode::Safe('Webhook endpoint returned 404. The plugin may not be installed, permalinks may not be configured, or the target is not vulnerable.')
  end

  #
  # Serve malicious PHP payload
  #
Metasploit Module: OP5 welcome Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/op5_welcome.rb
Platform: %w{linux unix}
Disclosure date: 2012-01-05
References: CVE-2012-0262, OSVDB-78065, URL-http://web.archive.org/web/[PII_REDACTED]4329/http://secunia.com:80/advisories/47417

Description:
This module exploits an arbitrary root command execution vulnerability in
          OP5 Monitor welcome. Ekelow AB has confirmed that OP5 Monitor versions 5.3.5,
          5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable.

Check method (fingerprinting):
vprint_status("Attempting to detect if the OP5 Monitor is vulnerable...")
    vprint_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")

    # Try running/timing 'ping localhost' to determine is system is vulnerable
    start = Time.now

    data = 'do=do=Login&password=`ping -c 10 127.0.0.1`';
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'method' => 'POST',
      'proto' => 'HTTPS',
      'data' => data,
      'headers' =>
      {
        'Connection' => 'close',
      }
    }, 25)
    elapsed = Time.now - start
    if elapsed >= 5
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress File Manager Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_file_manager_rce.rb
Disclosure date: 2020-09-09
References: URL-https://github.com/w4fz5uck5/wp-file-manager-0day, URL-https://www.tenable.com/cve/CVE-2020-25213, CVE-2020-25213

Description:
The File Manager (wp-file-manager) plugin from 6.0 to 6.8 for WordPress allows remote attackers to upload and
          execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php
          extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write
          PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory.

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    # check the plugin version from readme
    check_plugin_version_from_readme('wp-file-manager', '6.9', '6.0')
  end
Metasploit Module: Oracle ATS Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/oracle_ats_file_upload.rb
Platform: win
Disclosure date: 2016-01-20

Description:
This module exploits an authentication bypass and arbitrary file upload
          in Oracle Application Testing Suite (OATS), version 12.4.0.2.0 and
          unknown earlier versions, to upload and execute a JSP shell.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/admin/Login.do'
    )

    if res && res.body.include?('12.4.0.2.0')
      CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: SPIP connect Parameter PHP Injection
Type: exploit
Path: modules/exploits/multi/http/spip_connect_exec.rb
Platform: php
Disclosure date: 2012-07-04
References: CVE-2013-4557, OSVDB-83543, BID-54292, URL-http://contrib.spip.net/SPIP-3-0-3-2-1-16-et-2-0-21-a-l-etape-303-epate-la
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a PHP code injection vulnerability in SPIP. The vulnerability exists
          in the connect parameter, allowing an unauthenticated user to execute arbitrary commands
          with web user privileges. Branches 2.0, 2.1, and 3 are affected. Vulnerable versions are
          < 2.0.21, < 2.1.16, and < 3.0.3. This module is compatible with both Unix/Linux and Windows
          platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20 on Apache running
          on Ubuntu, Fedora, and Windows Server.

Check method (fingerprinting):
rversion = spip_version || spip_plugin_version('spip')
    return Exploit::CheckCode::Unknown('Unable to determine the version of SPIP') unless rversion

    print_status("SPIP Version detected: #{rversion}")

    vulnerable_ranges = [
      { start: '2.0.0', end: '2.0.20' },
      { start: '2.1.0', end: '2.1.15' },
      { start: '3.0.0', end: '3.0.2' }
    ]

    vulnerable_ranges.each do |range|
      if rversion.between?(Rex::Version.new(range[:start]), Rex::Version.new(range[:end]))
        return Exploit::CheckCode::Appears('The SPIP version is in the vulnerable range')
      end
    end

    Exploit::CheckCode::Safe('The SPIP version is not in the vulnerable range')
  end
Metasploit Module: Traq admincp/common.php Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/traq_plugin_exec.rb
Platform: php
Disclosure date: 2011-12-12
References: CVE-2011-10013, OSVDB-77556, EDB-18213, URL-http://traqproject.org/

Description:
This module exploits an arbitrary command execution vulnerability in
          Traq 2.0 to 2.3. It's in the admincp/common.php script.

          This function is called in each script located in the /admicp/ directory to
          make sure the user has admin rights. This is a broken authorization schema
          because the header() function doesn't stop the execution flow.
          This can be exploited by malicious users to execute admin functionality,
          e.g. execution of arbitrary PHP code leveraging of plugins.php functionality.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], "admincp", "login.php")

    res = send_request_raw(
      {
        'uri' => uri
      }, 25
    )

    if (res and res.body =~ /Powered by Traq 2.[0-3]/)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wordpress Popular Posts Authenticated RCE
Type: exploit
Path: modules/exploits/multi/http/wp_popular_posts_rce.rb
Platform: php
Disclosure date: 2021-06-11
References: EDB-50129, URL-https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/, URL-https://plugins.trac.wordpress.org/changeset/2542638, URL-https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601, CVE-2021-42362

Description:
This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080.
          The FQDN must also not resolve to a reserved address (192/172/127/10).  The server must also respond to a HEAD request
          for the payload, prior to getting a GET request.
          This exploit leverages an authenticated improper input validation in Wordpress plugin Popular Posts <= 5.3.2.
          The exploit chain is rather complicated.  Authentication is required and 'gd' for PHP is required on the server.
          Then the Popular Post plugin is reconfigured to allow for an arbitrary URL for the post image in the widget.
          A post is made, then requests are sent to the post to make it more popular than the previous #1 by 5. Once
          the post hits the top 5, and after a 60sec (we wait 90) server cache refresh, the homepage widget is loaded
          which triggers the plugin to download the payload from our server. Our payload has a 'GIF' header, and a
          double extension ('.gif.php') allowing for arbitrary PHP code to be executed.

Check method (fingerprinting):
return CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online?

    checkcode = check_plugin_version_from_readme('wordpress-popular-posts', '5.3.3')
    if checkcode == CheckCode::Safe
      print_error('Popular Posts not a vulnerable version')
    end
    return checkcode
  end
Metasploit Module: Open Web Analytics 1.7.3 - Remote Code Execution (RCE)
Type: exploit
Path: modules/exploits/multi/http/open_web_analytics_rce.rb
Platform: php
Disclosure date: 2022-03-18
References: CVE-2022-24637, EDB-51026, URL-https://devel0pment.de/?p=2494

Description:
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive
          user information, which can be used to gain admin privileges by leveraging cache hashes.
          This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled
          by the PHP interpreter.

Check method (fingerprinting):
res = check_connection
    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Safe('Target is not running Open Web Analytics') if !res.body.include?('Open Web Analytics')

    version = Rex::Version.new(res.body.scan(/version=([\d.]+)/).flatten.first)
    return CheckCode::Detected("Open Web Analytics #{version} detected") unless version < Rex::Version.new('1.7.4')

    CheckCode::Appears("Open Web Analytics #{version} is vulnerable")
  end
Metasploit Module: SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution
Type: exploit
Path: modules/exploits/multi/sap/sap_soap_rfc_sxpg_call_system_exec.rb
Platform: unix
Disclosure date: Mar 26 2013
References: OSVDB-93537, URL-https://labs.f-secure.com/tools/sap-metasploit-modules/
Targets: Linux, Windows x64

Description:
This module abuses the SAP NetWeaver SXPG_CALL_SYSTEM function, on the SAP SOAP
        RFC Service, to execute remote commands. This module needs SAP credentials with
        privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested
        successfully on Windows 2008 64-bit and Linux 64-bit platforms.

Check method (fingerprinting):
data = rand_text_alphanumeric(rand(4..7))
    res = send_soap_request(data)
    if res and res.code == 500 and res.body =~ /faultstring/
      return Exploit::CheckCode::Detected('SAP SOAP RFC SXPG service detected')
    end

    return Exploit::CheckCode::Safe('SAP SOAP RFC SXPG service not detected')
  end
Metasploit Module: SAP Management Console OSExecute Payload Execution
Type: exploit
Path: modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
Platform: linux
Disclosure date: 2011-03-08
Authors: juan vazquez
References: URL-http://blog.c22.cc/toolsscripts/metasploit-modules/sap_mgmt_con_osexecute/
Targets: Linux, Windows Universal

Description:
This module executes an arbitrary payload through the SAP Management Console
          SOAP Interface.  A valid username and password for the SAP Management Console must
          be provided. This module has been tested successfully on both Windows and Linux
          platforms running SAP Netweaver. In order to exploit a Linux platform, the target
          system must have available the wget command.

Check method (fingerprinting):
begin
      res = send_soap_request('')
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    if res and res.code == 200 and res.headers['Server'] =~ /gSOAP/ and res.body =~ /OSExecuteResponse/
      return Exploit::CheckCode::Appears('SAP Management Console OS command execution available')
    elsif res and res.code == 500 and (res.body =~ /Invalid Credentials/ or res.body =~ /Permission denied/)
      return Exploit::CheckCode::Detected('SAP Management Console detected but credentials are invalid')
    elsif res and res.headers['Server'] =~ /gSOAP/
      return Exploit::CheckCode::Unknown('SAP Management Console gSOAP detected but could not confirm vulnerability')
    end

    return Exploit::CheckCode::Safe('SAP Management Console not detected')
  end
Metasploit Module: SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution
Type: exploit
Path: modules/exploits/multi/sap/sap_soap_rfc_sxpg_command_exec.rb
Platform: unix
Disclosure date: May 8 2012
References: URL-http://labs.mwrinfosecurity.com/blog/2012/09/03/sap-parameter-injection, URL-https://service.sap.com/sap/support/notes/1764994, URL-https://service.sap.com/sap/support/notes/1341333
Targets: Linux, Windows x64

Description:
This module abuses the SAP NetWeaver SXPG_COMMAND_EXECUTE function, on the SAP
        SOAP RFC Service, to execute remote commands. This module needs SAP credentials with
        privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested
        successfully on Windows 2008 64-bit and Linux 64-bit platforms.

Check method (fingerprinting):
data = rand_text_alphanumeric(rand(4..7))
    res = send_soap_request(data)
    if res and res.code == 500 and res.body =~ /faultstring/
      return Exploit::CheckCode::Detected('SAP SOAP RFC SXPG service detected')
    end

    return Exploit::CheckCode::Safe('SAP SOAP RFC SXPG service not detected')
  end
Metasploit Module: SAP Solution Manager remote unauthorized OS commands execution
Type: exploit
Path: modules/exploits/multi/sap/cve_2020_6207_solman_rs.rb
Platform: linux
Disclosure date: 2020-10-03
References: CVE-2020-6207, URL-https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf, URL-https://github.com/chipik/SAP_EEM_CVE-2020-6207
Targets: Linux, Windows

Description:
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of
          SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication
          checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,
          send HTTP request (SSRF) and execute OS command on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.

          Successful exploitation will allow unauthenticated remote attackers to get reverse shell from connected to the SolMan
          agent as the user under which it runs SMDAgent service, usually daaadm.

Check method (fingerprinting):
setup_variables
    begin
      agents = make_agents_array
    rescue RuntimeError
      return Exploit::CheckCode::Unknown('Could not retrieve agent list from Solution Manager')
    end
    if agents.empty?
      print_status("Solution Manager server: #{@host}:#{@port} is vulnerable but no agents are connected!")
    else
      print_good("Successfully retrieved agent list:\n#{pretty_agents_table(agents)}")
    end
    report_service_and_vuln
    Exploit::CheckCode::Vulnerable('SAP Solution Manager is vulnerable to CVE-2020-6207')
  end
Metasploit Module: Nodejs js-yaml load() Code Execution
Type: exploit
Path: modules/exploits/multi/fileformat/nodejs_js_yaml_load_code_exec.rb
Platform: nodejs
Disclosure date: 2013-06-28
References: CVE-2013-4660, OSVDB-94656, BID-60867, URL-https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/

Description:
This module can be used to abuse node.js applications that parse user-supplied YAML input
          using the load() function from the 'js-yaml' package < 2.0.5, which doesn't properly handle
          the unsafe !!js/function tag, allowing to specify a self-executing function which results
          on execution of arbitrary javascript code.
Metasploit Module: PEAR Archive_Tar 1.4.10 Arbitrary File Write
Type: exploit
Path: modules/exploits/multi/fileformat/archive_tar_arb_file_write.rb
Platform: php
Disclosure date: 2020-11-17
References: URL-https://github.com/pear/Archive_Tar/issues/33, CVE-2020-28949

Description:
This module takes advantages of Archive_Tar <= 1.4.10's lack of validation of file stream wrappers contained
          within filenames to write an arbitrary file containing user controlled content to an arbitrary file
          on disk. Note that the file will be written to disk with the permissions of the user that PHP is
          running as, so it may not be possible to overwrite some files if the PHP user is not appropriately
          privileged.