deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cayin xPost wayfinder_seqid SQLi to RCE
Type: exploit
Path: modules/exploits/windows/http/cayin_xpost_sql_rce.rb
Platform: java
Disclosure date: 2020-06-04
References: EDB-48558, URL-https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php, CVE-2020-7356

Description:
This module exploits an unauthenticated SQLi in Cayin xPost <=2.5.  The
          wayfinder_meeting_input.jsp file's wayfinder_seqid parameter can be injected
          with a blind SQLi.  Since this app bundles MySQL and apache Tomcat the
          environment is pretty static and therefore the default settings should
          work.  Results in SYSTEM level access.
          Only the java/jsp_shell_reverse_tcp and java/jsp_shell_bind_tcp payloads
          seem to be valid.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'cayin', 'js', 'English', 'language.js')
    )

    if res.nil? || res.code != 200
      return CheckCode::Safe('Could not connect to the web service, check URI Path and IP')
    end

    %r{// xPost v(?<version>[\d.]+) } =~ res.body

    if version && Rex::Version.new(version) <= Rex::Version.new('2.5')
      print_good("Version Detected: #{version}")
      return CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    # try a backup plan, at least verify the title
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'cayin', 'index.jsp')
    )

    if res.nil? || res.code != 200
      return CheckCode::Safe('Could not connect to the web service, check URI Path and IP')

    end

    if res.body =~ %r{<title>xPost</title>}
      vprint_good('HTML Title includes xPost')
      return CheckCode::Detected('Target service detected as xPost')
    end
    CheckCode::Safe('Target is not vulnerable')
  rescue ::Rex::ConnectionError
    CheckCode::Safe('Could not connect to the web service, check URI Path and IP')
  end
Metasploit Module: Microsoft Exchange ProxyShell RCE
Type: exploit
Path: modules/exploits/windows/http/exchange_proxyshell_rce.rb
Platform: windows
Disclosure date: 2021-04-06
References: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, URL-https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1, URL-https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf, URL-https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/, URL-https://github.com/dmaasland/proxyshell-poc
Targets: Windows Powershell, Windows Dropper, Windows Command

Description:
This module exploits a vulnerability on Microsoft Exchange Server that
          allows an attacker to bypass the authentication (CVE-2021-31207), impersonate an
          arbitrary user (CVE-2021-34523) and write an arbitrary file (CVE-2021-34473) to achieve
          the RCE (Remote Code Execution).

          By taking advantage of this vulnerability, you can execute arbitrary
          commands on the remote Microsoft Exchange Server.

          This vulnerability affects Exchange 2013 CU23 < 15.0.1497.15,
          Exchange 2016 CU19 < 15.1.2176.12, Exchange 2016 CU20 < 15.1.2242.5,
          Exchange 2019 CU8 < 15.2.792.13, Exchange 2019 CU9 < 15.2.858.9.

          All components are vulnerable by default.

Check method (fingerprinting):
@ssrf_email ||= Faker::Internet.email
    res = send_http('GET', '/mapi/nspi/')
    return CheckCode::Unknown('No response received from target') if res.nil?
    return CheckCode::Safe('Exchange MAPI/HTTP endpoint not detected') unless res.code == 200 && res.get_html_document.xpath('//head/title').text == 'Exchange MAPI/HTTP Connectivity Endpoint'

    CheckCode::Vulnerable('Target is vulnerable')
  end
Metasploit Module: Ipswitch WhatsUp Gold 8.03 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ipswitch_wug_maincfgret.rb
Platform: win
Disclosure date: 2004-08-25
References: CVE-2004-0798, OSVDB-9177, BID-11043

Description:
This module exploits a buffer overflow in IPswitch WhatsUp Gold 8.03. By
          posting a long string for the value of 'instancename' in the _maincfgret.cgi
          script an attacker can overflow a buffer and execute arbitrary code on the system.
Metasploit Module: ManageEngine ServiceDesk Plus CVE-2021-44077
Type: exploit
Path: modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
Platform: win
Disclosure date: 2021-09-16
References: CVE-2021-44077, URL-https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above, URL-https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021, URL-https://www.cisa.gov/uscert/ncas/alerts/aa21-336a, URL-https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/, URL-https://attackerkb.com/topics/qv2aD8YfMN/cve-2021-44077/rapid7-analysis, URL-https://xz.aliyun.com/t/10631

Description:
This module exploits CVE-2021-44077, an unauthenticated remote code
          execution vulnerability in ManageEngine ServiceDesk Plus, to upload an
          EXE (msiexec.exe) and execute it as the SYSTEM account.

          Note that build 11305 is vulnerable to the authentication bypass but
          not the file upload. The module will check for an exploitable build.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/RestAPI/ImportTechnicians')
    )

    unless res
      return CheckCode::Unknown('Target failed to respond to check.')
    end

    # NOTE: /RestAPI/ImportTechnicians was removed after build 11303
    unless res.code == 200 && res.get_html_document.at('//form[@name="ImportTechnicians"]')
      return CheckCode::Safe('/RestAPI/ImportTechnicians is not present.')
    end

    CheckCode::Appears('/RestAPI/ImportTechnicians is present.')
  end
Metasploit Module: SAP ConfigServlet Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/sap_configservlet_exec_noauth.rb
Platform: win
Disclosure date: 2012-11-01
References: OSVDB-92704, EDB-24996, URL-http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf
Targets: Windows generic

Description:
This module allows remote code execution via operating system commands through the
          SAP ConfigServlet without any authentication. This module has been tested successfully
          with SAP NetWeaver 7.00 and 7.01 on Windows Server 2008 R2.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'ConfigServlet')
    begin
      res = send_evil_request(uri, "whoami", 20)
    rescue
      vprint_error("An error has occurred while sending the malicious request")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    if !res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.body.include?("Process created")
      return Exploit::CheckCode::Vulnerable('Target is vulnerable')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Commvault Command-Line Argument Injection to Traversal Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb
Platform: windows
Disclosure date: 2025-08-19
References: CVE-2025-57790, CVE-2025-57791, CVE-2025-57788, URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_1.html, URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_2.html, URL-https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability

Description:
This module exploits an unauthenticated remote code execution exploit chain for Commvault,
          tracked as CVE-2025-57790 and CVE-2025-57791. A command-line injection permits unauthenticated
          access to the 'localadmin' account, which then facilitates code execution via expression
          language injection. CVE-2025-57788 is also leveraged to leak the target host name, which is
          necessary knowledge to exploit the remote code execution chain. This module executes in
          the context of 'NETWORK SERVICE' on Windows.

Check method (fingerprinting):
# Query an unauthenticated web API endpoint to attempt to extract the PublicSharingUser GUID password
    res = check_commvault_info

    return CheckCode::Unknown('Failed to get a response from the target') unless res

    # If the response body contains "cv-gorkha", we assume it's Commvault
    if res.code == 200 && res.body.include?('cv-gorkha')
      vprint_status('The server returned a body that included the string cv-gorkha, looks like Commvault')

      regex = /"cv-gorkha\\":\\"([a-zA-Z0-9-]+)\\"/
      sharinguser_pass = res.body.scan(regex)[0][0]

      # If the regex fails to extract the GUID, we return Safe
      if sharinguser_pass.blank?
        return CheckCode::Safe('The target returned an unexpected response that did not contain the desired GUID')
      end

      vprint_good("Fetched GUID: #{sharinguser_pass}")

      vprint_status('Attempting to login as PublicSharingUser')
      res = login_as_publicsharinguser(sharinguser_pass)

      return CheckCode::Unknown('Failed to get a response from the target') unless res

      if res.code != 200
        CheckCode::Detected('Commvault detected, login as PublicSharingUser failed because a non-200 status was returned')
      end

      # Extract the token from the login response
      regex = /(QSDK [a-zA-Z0-9]+)/
      psu_token = res.body.scan(regex)[0][0]

      if psu_token.blank?
        CheckCode::Detected('Commvault detected, login as PublicSharingUser failed because no token was returned')
      else
Metasploit Module: Hewlett-Packard Power Manager Administration Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_power_manager_login.rb
Platform: win
Disclosure date: 2009-11-04
References: CVE-2009-2685, OSVDB-59684

Description:
This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2.
          Sending a specially crafted POST request with an overly long Login string, an
          attacker may be able to execute arbitrary code.
Metasploit Module: VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb
Platform: win
Disclosure date: 2013-05-15
References: CVE-2013-3520, OSVDB-94188, BID-60484, ZDI-13-147

Description:
This module exploits a code execution flaw in VMware vCenter Chargeback Manager,
          where the ImageUploadServlet servlet allows unauthenticated file upload. The files
          are uploaded to the /cbmui/images/ web path, where JSP code execution is allowed.
          The module has been tested successfully on VMware vCenter Chargeback Manager 2.0.1
          on Windows 2003 SP2.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("cbmui", "en_US", "themes", "excel", "index.htm"),
    })

    if res and res.code == 200 and res.body =~ /vCenter Chargeback Manager/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability
Type: exploit
Path: modules/exploits/windows/http/oracle_beehive_evaluation.rb
Platform: win
Disclosure date: 2010-06-09
References: CVE-2010-4417, ZDI-11-020, URL-http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

Description:
This module exploits a vulnerability found in Oracle BeeHive. The processEvaluation method
          found in voice-servlet can be abused to write a malicious file onto the target machine, and
          gain remote arbitrary code execution under the context of SYSTEM.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', 'showRecxml.jsp'))

    if res && /RECXML Prompt Tester/ === res.body
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability
Type: exploit
Path: modules/exploits/windows/http/manageengine_connectionid_write.rb
Platform: win
Disclosure date: 2015-12-14
References: URL-https://www.rapid7.com/blog/post/2015/12/14/r7-2015-22-manageengine-desktop-central-9-fileuploadservlet-connectionid-vulnerability-cve-2015-8249, CVE-2015-8249

Description:
This module exploits a vulnerability found in ManageEngine Desktop Central 9. When
          uploading a 7z file, the FileUploadServlet class does not check the user-controlled
          ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to
          inject a null bye at the end of the value to create a malicious file with an arbitrary
          file type, and then place it under a directory that allows server-side scripts to run,
          which results in remote code execution under the context of SYSTEM.

          Please note that by default, some ManageEngine Desktop Central versions run on port 8020,
          but older ones run on port 8040. Also, using this exploit will leave debugging information
          produced by FileUploadServlet in file rdslog0.txt.

          This exploit was successfully tested on version 9, build 90109 and build 91084.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, '/configurations.do')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri
    })

    unless res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    build_number = get_build_number(res)
    vprint_status("Found build number: #{build_number}")

    html_title = get_html_title(res)
    vprint_status("Found title: #{html_title}")

    if build_number <= '91084'
      return Exploit::CheckCode::Appears("Detected vulnerable version: #{build_number}")
    elsif /ManageEngine Desktop Central/ === html_title
      return Exploit::CheckCode::Detected("Target detected with version: #{build_number}")
    end

    Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{build_number}")
  end
Metasploit Module: Savant 3.1 Web Server Overflow
Type: exploit
Path: modules/exploits/windows/http/savant_31_overflow.rb
Platform: win
Disclosure date: 2002-09-10
References: CVE-2002-1120, OSVDB-9829, BID-5686, EDB-787

Description:
This module exploits a stack buffer overflow in Savant 3.1 Web Server. The service
          supports a maximum of 10 threads (for a default install). Each exploit attempt
          generally causes a thread to die whether successful or not. Therefore, in a default
          configuration, you only have 10 chances.

          Due to the limited space available for the payload in this exploit module, use of the
          "ord" payloads is recommended.

Check method (fingerprinting):
info = http_fingerprint # check method
    if info and (info =~ /Savant\/3\.1/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Microsoft SharePoint Server-Side Include and ViewState RCE
Type: exploit
Path: modules/exploits/windows/http/sharepoint_ssi_viewstate.rb
Platform: win
Disclosure date: 2020-10-13
References: CVE-2020-16952, URL-https://srcincite.io/advisories/src-2020-0022/, URL-https://srcincite.io/pocs/cve-2020-16952.py.txt, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a server-side include (SSI) in SharePoint to leak
          the web.config file and forge a malicious ViewState with the extracted
          validation key.

          This exploit is authenticated and requires a user with page creation
          privileges, which is a standard permission in SharePoint.

          The web.config file will be stored in loot once retrieved, and the
          VALIDATION_KEY option can be set to short-circuit the SSI and trigger
          the ViewState deserialization.

          Tested against SharePoint 2019 on Windows Server 2016.

Check method (fingerprinting):
build = sharepoint_get_version('cookie' => cookie)

    if build.nil?
      return CheckCode::Unknown('Failed to retrieve the SharePoint version number')
    end

    if vuln_builds.any? { |build_range| build.between?(*build_range) }
      return CheckCode::Appears("SharePoint #{build} is a vulnerable build.")
    end

    CheckCode::Safe("SharePoint #{build} is not a vulnerable build.")
  end
Metasploit Module: ManageEngine Applications Manager Authenticated Code Execution
Type: exploit
Path: modules/exploits/windows/http/manageengine_apps_mngr.rb
Platform: win
Disclosure date: Apr 08 2011
Authors: Jacob Giannantonio <JGiannan[at]gmail.com>
References: EDB-17152

Description:
This module logs into the Manage Engine Applications Manager to upload a
          payload to the file system and a batch script that executes the payload.
Metasploit Module: HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_snmpviewer_actapp.rb
Platform: win
Disclosure date: 2010-05-11
References: CVE-2010-1552, OSVDB-64975, BID-40068, ZDI-10-083, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02153379

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
          prior to NNM_01203. By making a specially crafted HTTP request to the "snmpviewer.exe"
          CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary
          code.

          The vulnerable code lies within a function within "snmpviewer.exe" with a
          timestamp prior to April 7th, 2010. This vulnerability is triggerable via either a GET
          or POST request. The request must contain 'act' and 'app' parameters which, when
          combined, total more than the 1024 byte stack buffer can hold.

          It is important to note that this vulnerability must be exploited by overwriting SEH.
          While the saved return address can be smashed, a function call that occurs before
          the function returns calls "exit".
Metasploit Module: Xitami 2.5c2 Web Server If-Modified-Since Overflow
Type: exploit
Path: modules/exploits/windows/http/xitami_if_mod_since.rb
Platform: win
Disclosure date: 2007-09-24
Authors: aushack
References: CVE-2007-5067, OSVDB-40594, OSVDB-40595, BID-25772, EDB-4450

Description:
This module exploits a stack buffer overflow in the iMatix Corporation
          Xitami Web Server. If a malicious user sends an	If-Modified-Since
          header containing an overly long string, it may be possible to
          execute a payload remotely. Due to size constraints, this module uses
          the Egghunter technique.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.1\r\nHost: #{rhost}\r\n\r\n")
    banner = sock.get_once
    disconnect

    if (banner.to_s =~ /Xitami/)
      vprint_status("Banner: #{banner}")
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: BadBlue 2.72b PassThru Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/badblue_passthru.rb
Platform: win
Disclosure date: 2007-12-10
References: CVE-2007-6377, OSVDB-42416, BID-26803

Description:
This module exploits a stack buffer overflow in the PassThru
          functionality in ext.dll in BadBlue 2.72b and earlier.
Metasploit Module: HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb
Platform: win
Disclosure date: 2010-06-08
References: CVE-2010-1960, OSVDB-65427, BID-40637, ZDI-10-105

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
          prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe'
          CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code.
          The vulnerable code is within the option parsing function within "ovwebsnmpsrv.exe" with a
          timestamp prior to April 7th, 2010.

          Reaching the vulnerable code requires a 'POST' request with an 'arg' parameter that, when combined
          with some static text, exceeds 10240 bytes. The parameter must begin with a dash. It is
          important to note that this vulnerability must be exploited by overwriting SEH. This is since
          overflowing the buffer with controllable data always triggers an access violation when
          attempting to write static text beyond the end of the stack.

          Exploiting this issue is a bit tricky due to a restrictive character set. In order to accomplish
          arbitrary code execution, a double-backward jump is used in combination with the Alpha2
          encoder.
Metasploit Module: Symantec Endpoint Protection Manager Authentication Bypass and Code Execution
Type: exploit
Path: modules/exploits/windows/http/sepm_auth_bypass_rce.rb
Platform: win
Disclosure date: 2015-07-31
References: CVE-2015-1486, CVE-2015-1487, CVE-2015-1489, URL-http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html
Targets: Automatic

Description:
This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager
          in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. The vulnerabilities
          include an authentication bypass, a directory traversal and a privilege escalation to
          get privileged code execution.
Metasploit Module: Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability
Type: exploit
Path: modules/exploits/windows/http/osb_uname_jlist.rb
Platform: win
Disclosure date: 2010-07-13
References: CVE-2010-0904, OSVDB-66338, ZDI-10-118
Targets: Windows Universal

Description:
This module exploits an authentication bypass vulnerability
          in login.php. In conjunction with the authentication bypass issue,
          the 'jlist' parameter in property_box.php can be used to execute
          arbitrary system commands.
          This module was tested against Oracle Secure Backup version 10.3.0.1.0