deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cambium cnPilot r200/r201 Command Execution as 'root'
Type: auxiliary
Path: modules/auxiliary/admin/http/cnpilot_r_cmd_exec.rb
References: CVE-2017-5259, URL-https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

Description:
Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to
          4.3.3-R4, contain an undocumented, backdoor 'root' shell. This shell is
          accessible via a specific url, to any authenticated user. The module uses this
          shell to execute arbitrary system commands as 'root'.
Metasploit Module: SysAid Help Desk Administrator Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/http/sysaid_admin_acct.rb
Disclosure date: 2015-06-03
References: CVE-2015-2993, URL-https://seclists.org/fulldisclosure/2015/Jun/8, URL-https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt

Description:
This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated
          user to create an administrator account. Note that this exploit will only work once. Any
          subsequent attempts will fail. On the other hand, the credentials must be verified
          manually. This module has been tested on SysAid 14.4 in Windows and Linux.
Metasploit Module: NETGEAR WNR2000v5 Administrator Password Recovery
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_wnr2000_pass_recovery.rb
Disclosure date: 2016-12-20
References: CVE-2016-10175, CVE-2016-10176, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt, URL-https://seclists.org/fulldisclosure/2016/Dec/72, URL-https://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability

Description:
The NETGEAR WNR2000 router has a vulnerability in the way it handles password recovery.
          This vulnerability can be exploited by an unauthenticated attacker who is able to guess
          the value of a certain timestamp which is in the configuration of the router.
          Brute forcing the timestamp token might take a few minutes, a few hours, or days, but
          it is guaranteed that it can be bruteforced.
          This module works very reliably and it has been tested with the WNR2000v5, firmware versions
          1.0.0.34 and 1.0.0.18. It should also work with the hardware revisions v4 and v3, but this
          has not been tested.
Metasploit Module: TYPO3 News Module SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/http/typo3_news_module_sqli.rb
Platform: php
Disclosure date: 2017-04-06
References: CVE-2017-7581, URL-http://www.ambionics.io/blog/typo3-news-module-sqli

Description:
This module exploits a SQL Injection vulnerability In TYPO3 NewsController.php
          in the news module 5.3.2 and earlier. It allows an unauthenticated user to execute arbitrary
          SQL commands via vectors involving overwriteDemand and OrderByAllowed. The SQL injection
          can be used to obtain password hashes for application user accounts. This module has been
          tested on TYPO3 3.16.0 running news extension 5.0.0.

          This module tries to extract username and password hash of the administrator user.
          It tries to inject sql and check every letter of a pattern, to see
          if it belongs to the username or password it tries to alter the ordering of results. If
          the letter doesn't belong to the word being extracted then all results are inverted
          (News #2 appears before News #1, so Pattern2 before Pattern1), instead if the letter belongs
          to the word being extracted then the results are in proper order (News #1 appears before News #2,
          so Pattern1 before Pattern2)
Metasploit Module: Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic
Type: auxiliary
Path: modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb
Disclosure date: 2017-09-23
References: CVE-2017-7921, URL-https://ipvm.com/reports/hik-exploit, URL-https://attackerkb.com/topics/PlLehGSmxT/cve-2017-7921, URL-https://seclists.org/fulldisclosure/2017/Sep/23

Description:
Many Hikvision IP cameras contain improper authentication logic which allows unauthenticated impersonation of any configured user account.
          The vulnerability has been present in Hikvision products since 2014. In addition to Hikvision-branded devices, it
          affects many white-labeled camera products sold under a variety of brand names.

          Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time
          of publishing (shodan search: '"App-webs" "200 OK"'). Some of these devices can never be patched due to to the
          vendor preventing users from upgrading the installed firmware on the affected device.

          This module utilizes the bug in the authentication logic to perform an unauthenticated password change of any user account on
          a vulnerable Hikvision IP Camera. This can then be utilized to gain full administrative access to the affected device.

Check method (fingerprinting):
begin
      password = Rex::Text.rand_text_alphanumeric(6..12)
      auth = Base64.encode64("admin:#{password}")
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'Security', 'users'),
        'vars_get' => {
          'auth' => auth.strip
        }
      })
    rescue StandardError => e
      elog("#{peer} - Communication error occurred: #{e.message}", error: e)
      return Exploit::CheckCode::Unknown("#{peer} - Communication error occurred: #{e.message}")
    end

    if res.nil?
      return Exploit::CheckCode::Unknown('No response received from the target!')
    elsif res && res.code == 200
      xml_res = res.get_xml_document
      print_status('Following users are available for password reset...')
      user_array = xml_res.css('User')
      return Exploit::CheckCode::Safe('No users were found in the returned CSS code!') if user_array.blank?

      user_array.each do |user|
        print_status("USERNAME:#{user&.at_css('userName')&.content} | ID:#{user&.at_css('id')&.content} | ROLE:#{user&.at_css('userLevel')&.content}")
      end
      return Exploit::CheckCode::Vulnerable('Unauthenticated access to user credentials succeeded')
    else
      return Exploit::CheckCode::Safe("Target returned HTTP #{res.code}")
    end
  end
Metasploit Module: Tomcat UTF-8 Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
Disclosure date: Jan 9 2009
References: URL-http://tomcat.apache.org/, OSVDB-47464, CVE-2008-2938, URL-http://www.securityfocus.com/archive/1/499926

Description:
This module tests whether a directory traversal vulnerability is present
        in versions of Apache Tomcat 4.1.0 - 4.1.37, 5.5.0 - 5.5.26 and 6.0.0
        - 6.0.16 under specific and non-default installations. The connector must have
        allowLinking set to true and URIEncoding set to UTF-8. Furthermore, the
        vulnerability actually occurs within Java and not Tomcat; the server must
        use Java versions prior to Sun 1.4.2_19, 1.5.0_17, 6u11 - or prior IBM Java
        5.0 SR9, 1.4.2 SR13, SE 6 SR4 releases. This module has only been tested against
        RedHat 9 running Tomcat 6.0.16 and Sun JRE 1.5.0-05. You may wish to change
        FILE (hosts,sensitive files), MAXDIRS and RPORT depending on your environment.
Metasploit Module: MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/http/iis_auth_bypass.rb
Disclosure date: 2010-07-02
References: CVE-2010-2731, OSVDB-66160, MSB-MS10-065, URL-https://soroush.secproject.com/blog/2010/07/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/

Description:
This module bypasses basic authentication for Internet Information Services (IIS).
          By appending the NTFS stream name to the directory name in a request, it is
          possible to bypass authentication.
Metasploit Module: NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset
Type: auxiliary
Path: modules/auxiliary/admin/http/nuuo_nvrmini_reset.rb
Disclosure date: 2016-08-04
References: CVE-2016-5676, US-CERT-VU-856152, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-nvr-vulns.txt, URL-https://seclists.org/bugtraq/2016/Aug/45

Description:
The NVRmini 2 Network Video Recorded and the ReadyNAS Surveillance application are vulnerable
          to an administrator password reset on the exposed web management interface.
          Note that this only works for unauthenticated attackers in earlier versions of the Nuuo firmware
          (before v1.7.6), otherwise you need an administrative user password.
          This exploit has been tested on several versions of the NVRmini 2 and the ReadyNAS Surveillance.
          It probably also works on the NVRsolo and other Nuuo devices, but it has not been tested
          in those devices.
Metasploit Module: Sophos Web Protection Appliance patience.cgi Directory Traversal
Type: auxiliary
Path: modules/auxiliary/admin/http/sophos_wpa_traversal.rb
Disclosure date: 2013-04-03
References: CVE-2013-2641, OSVDB-91953, BID-58833, EDB-24932, URL-https://web.archive.org/web/[PII_REDACTED]1204/http://www.sophos.com/en-us/support/knowledgebase/118969.aspx, URL-https://web.archive.org/web/[PII_REDACTED]4340/https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt

Description:
This module abuses a directory traversal in Sophos Web Protection Appliance, specifically
          on the /cgi-bin/patience.cgi component. This module has been tested successfully on the
          Sophos Web Virtual Appliance v3.7.0.
Metasploit Module: Pi-Hole Top Domains API Authenticated Exec
Type: auxiliary
Path: modules/auxiliary/admin/http/pihole_domains_api_exec.rb
Platform: php
Disclosure date: 2021-08-04
References: CVE-2021-32706

Description:
This exploits a command execution in Pi-Hole Web Interface <= 5.5.
          The Settings > API/Web inetrace page contains the field
          Top Domains/Top Advertisers which is validated by a regex which does not properly
          filter system commands, which can then be executed by calling the gravity
          functionality.  However, the regex only allows a-z, 0-9, _.

Check method (fingerprinting):
begin
      _version, web_version, _ftl = get_versions

      if web_version.nil?
        print_error("#{peer} - Could not connect to web service - no response or non-200 HTTP code")
        return Exploit::CheckCode::Unknown('Could not connect to web service')
      end

      if web_version && Rex::Version.new(web_version) <= Rex::Version.new('5.6')
        vprint_good("Web Interface Version Detected: #{web_version}")
        return Exploit::CheckCode::Appears("Pi-hole web interface version #{web_version} is vulnerable")
      else
        vprint_bad("Web Interface Version Detected: #{web_version}")
        return Exploit::CheckCode::Safe("Pi-hole web interface version #{web_version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      print_error("#{peer} - Could not connect to the web service")
      return Exploit::CheckCode::Unknown('Could not connect to the web service')
    end
    Exploit::CheckCode::Safe('Target does not appear to be Pi-hole')
  end
Metasploit Module: Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/http/allegro_rompager_auth_bypass.rb
Disclosure date: 2014-12-17
References: CVE-2014-9222, URL-https://web.archive.org/web/[PII_REDACTED]5858/http://mis.fortunecook.ie/, URL-https://web.archive.org/web/[PII_REDACTED]2911/http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf, URL-https://web.archive.org/web/[PII_REDACTED]0837/http://mis.fortunecook.ie/too-many-cooks-exploiting-tr069_tal-oppenheim_31c3.pdf

Description:
This module exploits HTTP servers that appear to be vulnerable to the
          'Misfortune Cookie' vulnerability which affects Allegro Software
          Rompager versions before 4.34 and can allow attackers to authenticate
          to the HTTP service as an administrator without providing valid
          credentials.
Metasploit Module: Wordpress MasterStudy Admin Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_masterstudy_privesc.rb
Disclosure date: 2022-02-18
References: CVE-2022-0441, URL-https://gist.github.com/numanturle/4762b497d3b56f1a399ea69aa02522a6, EDB-50752

Description:
MasterStudy LMS, a WordPress plugin,
          prior to 2.7.6 is affected by a privilege escalation where an unauthenticated
          user is able to create an administrator account for wordpress itself.

Check method (fingerprinting):
unless wordpress_and_online?
      return Msf::Exploit::CheckCode::Safe('Server not online or not detected as wordpress')
    end

    checkcode = check_plugin_version_from_readme('masterstudy-lms-learning-management-system', '2.7.6')
    if checkcode == Msf::Exploit::CheckCode::Safe
      return Msf::Exploit::CheckCode::Safe('MasterStudy LMS version not vulnerable')
    end

    checkcode
  end
Metasploit Module: WordPress WP EasyCart Plugin Privilege Escalation
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb
Disclosure date: 2015-02-25
References: CVE-2015-2673, URL-https://rastating.github.io/wp-easycart-privilege-escalation-information-disclosure/

Description:
The WordPress WP EasyCart plugin from version 1.1.30 to 3.0.20 allows authenticated
          users of any user level to set any system option via a lack of validation in the
          ec_ajax_update_option and ec_ajax_clear_all_taxrates functions located in
          /inc/admin/admin_ajax_functions.php. The module first changes the admin e-mail address
          to prevent any notifications being sent to the actual administrator during the attack,
          re-enables user registration in case it has been disabled and sets the default role to
          be administrator. This will allow for the user to create a new account with admin
          privileges via the default registration page found at /wp-login.php?action=register.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-easycart', '3.0.21', '1.1.30')
  end
Metasploit Module: TrendMicro Data Loss Prevention 5.5 Directory Traversal
Type: auxiliary
Path: modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb
Disclosure date: Jan 9 2009
References: URL-http://tomcat.apache.org/, OSVDB-47464, OSVDB-73447, CVE-2008-2938, URL-http://www.securityfocus.com/archive/1/499926, EDB-17388, BID-48225

Description:
This module tests whether a directory traversal vulnerability is present
        in Trend Micro DLP (Data Loss Prevention) Appliance v5.5 build <= 1294.
        The vulnerability appears to be actually caused by the Tomcat UTF-8
        bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938.
        This module simply tests for the same bug with Trend Micro specific settings.
        Note that in the Trend Micro appliance, /etc/shadow is not used and therefore
        password hashes are stored and anonymously accessible in the passwd file.
Metasploit Module: SysAid Help Desk Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/sysaid_file_download.rb
Disclosure date: 2015-06-03
References: CVE-2015-2996, CVE-2015-2997, URL-https://seclists.org/fulldisclosure/2015/Jun/8, URL-https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt

Description:
This module exploits two vulnerabilities in SysAid Help Desk that allows
          an unauthenticated user to download arbitrary files from the system. First, an
          information disclosure vulnerability (CVE-2015-2997) is used to obtain the file
          system path, and then we abuse a directory traversal (CVE-2015-2996) to download
          the file. Note that there are some limitations on Windows, in that the information
          disclosure vulnerability doesn't work on a Windows platform, and we can only
          traverse the current drive (if you enter C:\afile.txt and the server is running
          on D:\ the file will not be downloaded).

          This module has been tested with SysAid 14.4 on Windows and Linux.
Metasploit Module: Plixer Scrutinizer NetFlow and sFlow Analyzer HTTP Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/http/scrutinizer_add_user.rb
Disclosure date: 2012-07-27
References: CVE-2012-2626, OSVDB-84318, URL-http://web.archive.org/web/[PII_REDACTED]1639/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt

Description:
This will add an administrative account to Scrutinizer NetFlow and sFlow Analyzer
          without any authentication.  Versions such as 9.0.1 or older are affected.
Metasploit Module: ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/http/manageengine_pmp_privesc.rb
Disclosure date: 2014-11-08
References: CVE-2014-8499, OSVDB-114485, URL-https://seclists.org/fulldisclosure/2014/Nov/18, URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_pmp_privesc.txt

Description:
ManageEngine Password Manager Pro (PMP) has an authenticated blind SQL injection
          vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate
          privileges and obtain Super Administrator access. A Super Administrator can then
          use his privileges to dump the whole password database in CSV format. PMP can use
          both MySQL and PostgreSQL databases but this module only exploits the latter as
          MySQL does not support stacked queries with Java. PostgreSQL is the default database
          in v6.8 and above, but older PMP versions can be upgraded and continue using MySQL,
          so a higher version does not guarantee exploitability. This module has been tested
          on v6.8 to v7.1 build 7104 on both Windows and Linux. The vulnerability is fixed in
          v7.1 build 7105 and above.

Check method (fingerprinting):
version = get_version
    case version
    when 0..7104
      return Exploit::CheckCode::Appears("ManageEngine PMP build #{version} is in the vulnerable range")
    when 7105..9998
      return Exploit::CheckCode::Safe("ManageEngine PMP build #{version} is patched")
    else
      return Exploit::CheckCode::Unknown("ManageEngine PMP build #{version} could not be assessed")
    end
  end
Metasploit Module: JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
Type: auxiliary
Path: modules/auxiliary/admin/http/jboss_bshdeployer.rb
References: CVE-2010-0738, OSVDB-64171, URL-https://www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now, URL-https://bugzilla.redhat.com/show_bug.cgi?id=574105

Description:
This module can be used to install a WAR file payload on JBoss servers that have
        an exposed "jmx-console" application. The payload is put on the server by
        using the jboss.system:BSHDeployer's createScriptDeployment() method.
Metasploit Module: Netgear PNPX_GetShareFolderList Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass.rb
Disclosure date: 2021-09-06
References: CVE-2021-45511, URL-https://kb.netgear.com/000063961/Security-Advisory-for-Authentication-Bypass-Vulnerability-on-the-D7000-and-Some-Routers-PSV-2021-0133, URL-https://ssd-disclosure.com/ssd-advisory-netgear-d7000-authentication-bypass/

Description:
This module targets an authentication bypass vulnerability in the mini_http binary of several Netgear Routers
          running firmware versions prior to 1.2.0.88, 1.0.1.80, 1.1.0.110, and 1.1.0.84. The vulnerability allows
          unauthenticated attackers to reveal the password for the admin user that is used to log into the
          router's administrative portal, in plaintext.

          Once the password has been been obtained, the exploit enables telnet on the target router and then utiltizes
          the auxiliary/scanner/telnet/telnet_login module to log into the router using the stolen credentials of the
          admin user. This will result in the attacker obtaining a new telnet session as the "root" user.

          This vulnerability was discovered and exploited by an independent security researcher who reported it to SSD.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => '/top.html',
      'method' => 'GET'
    )

    if res.nil?
      return Exploit::CheckCode::Unknown('Connection timed out.')
    end

    unless res.headers['WWW-Authenticate'] =~ /netgear/i
      return Exploit::CheckCode::Safe('Target does not appear to be a Netgear router!')
    end

    # Retrieve model name and firmware version
    res = send_request_cgi({ 'uri' => '/currentsetting.htm' })
    if res.nil?
      return Exploit::CheckCode::Unknown('Connection timed out.')
    end

    data = res.to_s
    firmware_version = data.match(/^Firmware=V(\d+\.\d+\.\d+\.\d+)_(\d+\.\d+\.\d+)/)
    if firmware_version.nil?
      return Exploit::CheckCode::Unknown('Could not retrieve firmware version!')
    end

    major_version = firmware_version[1]
    minor_version = firmware_version[2]

    model_name = data.match(/Model=([a-zA-Z0-9]+)/)
    if model_name.nil?
      return Exploit::CheckCode::Unknown('Could not retrieve model of the router!')
    end

    model_name = model_name[1]

    # Check model is actually vulnerable
    vulnerable_router_models = ['AC2100', 'AC2400', 'AC2600', 'D7000', 'R6220', 'R6230', 'R6260', 'R6330', 'R6350', 'R6700v2', 'R6800', 'R6850', 'R6900v2', 'R7200', 'R7350', 'R7400', 'R7450']
    unless vulnerable_router_models.include?(model_name)
      return Exploit::CheckCode::Safe('Not a vulnerable router model!')
    end

    # Check version is vulnerable
    print_status("Target is a #{model_name} router running fi
Metasploit Module: HP Web JetAdmin 6.5 Server Arbitrary Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb
Disclosure date: 2004-04-27
References: OSVDB-5798, BID-10224, EDB-294

Description:
This module abuses a command execution vulnerability within the
          web based management console of the Hewlett-Packard Web JetAdmin
          network printer tool v6.2 - v6.5. It is possible to execute commands
          as SYSTEM without authentication. The vulnerability also affects POSIX
          systems, however at this stage the module only works against Windows.
          This module does not apply to HP printers.
Metasploit Module: Ulterius Server File Download Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/http/ulterius_file_download.rb
References: EDB-43141, CVE-2017-16806

Description:
This module exploits a directory traversal vulnerability in Ulterius Server < v1.9.5.0
          to download files from the affected host. A valid file path is needed to download a file.
          Fortunately, Ulterius indexes every file on the system, which can be stored in the
          following location:

          http://ulteriusURL:port/.../fileIndex.db.

          This module can download and parse the fileIndex.db file. There is also an option to
          download a file using a provided path.