deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Netgear R6700v3 Unauthenticated LAN Admin Password Reset
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb
Disclosure date: 2020-06-15
References: URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/tokyo_drift/tokyo_drift.md, URL-https://kb.netgear.com/000061982/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Mobile-Routers-Modems-Gateways-and-Extenders, CVE-2020-10923, CVE-2020-10924, ZDI-20-703, ZDI-20-704

Description:
This module targets ZDI-20-704 (aka CVE-2020-10924), a buffer overflow vulnerability in the UPNP daemon (/usr/sbin/upnpd),
          on Netgear R6700v3 routers running firmware versions from V1.0.2.62 up to but not including V1.0.4.94, to reset
          the password for the 'admin' user back to its factory default of 'password'. Authentication is bypassed by
          using ZDI-20-703 (aka CVE-2020-10923), an authentication bypass that occurs when network adjacent
          computers send SOAPAction UPnP messages to a vulnerable Netgear R6700v3 router. Currently this module only
          supports exploiting Netgear R6700v3 routers running either the V1.0.0.4.82_10.0.57 or V1.0.0.4.84_10.0.58
          firmware, however support for other firmware versions may be added in the future.

          Once the password has been reset, attackers can use the exploit/linux/telnet/netgear_telnetenable module to send a
          special packet to port 23/udp of the router to enable a telnet server on port 23/tcp. The attacker can
          then log into this telnet server using the new password, and obtain a shell as the "root" user.

          These last two steps have to be done manually, as the authors did not reverse the communication with the web interface.
          It should be noted that successful exploitation will result in the upnpd binary crashing on the target router.
          As the upnpd binary will not restart until the router is rebooted, this means that attackers can only exploit
          this vulnerability once per reboot of the router.

          This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro +
          Radek Domanski).

Check method (fingerprinting):
target_version = retrieve_version
    print_status("Target is running firmware version #{target_version}")
    if (target_version < Rex::Version.new('1.0.4.94')) && (target_version >= Rex::Version.new('1.0.2.62'))
      return Exploit::CheckCode::Appears("NETGEAR R6700 firmware #{target_version} is in the vulnerable range")
    else
      return Exploit::CheckCode::Safe("NETGEAR R6700 firmware #{target_version} is not vulnerable")
    end
  end
Metasploit Module: WebNMS Framework Server Arbitrary Text File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/webnms_file_download.rb
Disclosure date: 2016-07-04
References: CVE-2016-6601, URL-https://blogs.securiteam.com/index.php/archives/2712, URL-https://seclists.org/fulldisclosure/2016/Aug/54

Description:
This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an
          unauthenticated user to download files off the file system by using a directory
          traversal attack on the FetchFile servlet.
          Note that only text files can be downloaded properly, as any binary file will get
          mangled by the servlet. Also note that for Windows targets you can only download
          files that are in the same drive as the WebNMS installation.
          This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on
          Windows and Linux.
Metasploit Module: ZyXEL GS1510-16 Password Extractor
Type: auxiliary
Path: modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb
References: URL-https://github.com/rapid7/metasploit-framework/pull/2709

Description:
This module exploits a vulnerability in ZyXEL GS1510-16 routers
          to extract the admin password. Due to a lack of authentication on the
          webctrl.cgi script, unauthenticated attackers can recover the
          administrator password for these devices. The vulnerable device
          has reached end of life for support from the manufacturer, so it is
          unlikely this problem will be addressed.
Metasploit Module: Limesurvey Unauthenticated File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/limesurvey_file_download.rb
Disclosure date: 2015-10-12
References: CVE-2025-34120, URL-https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/, URL-https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015, URL-https://github.com/LimeSurvey/LimeSurvey/compare/2.06_plus_151014...2.06_plus_151016?w=1

Description:
This module exploits an unauthenticated file download vulnerability
          in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded
          as a ZIP and unzipped automatically, thus binary files can be downloaded.
Metasploit Module: Cambium cnPilot r200/r201 File Path Traversal
Type: auxiliary
Path: modules/auxiliary/admin/http/cnpilot_r_fpt.rb
References: CVE-2017-5261, URL-https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

Description:
This module exploits a File Path Traversal vulnerability in Cambium
          cnPilot r200/r201 to read arbitrary files off the file system. Affected
          versions - 4.3.3-R4 and prior.
Metasploit Module: D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/http/dlink_dir_300_600_exec_noauth.rb
Disclosure date: 2013-02-04
References: CVE-2013-10069, OSVDB-89861, EDB-24453, URL-https://eu.dlink.com/uk/en/products/dir-600-wireless-n-150-home-router, URL-http://www.s3cur1ty.de/home-network-horror-days, URL-http://www.s3cur1ty.de/m1adv2013-003

Description:
This module exploits an OS Command Injection vulnerability in some D-Link
          Routers like the DIR-600 rev B and the DIR-300 rev B. The vulnerability exists in
          command.php, which is accessible without authentication. This module has been
          tested with the versions DIR-600 2.14b01 and below, DIR-300 rev B 2.13 and below.
          In order to get a remote shell the telnetd could be started without any
          authentication.
Metasploit Module: JBoss Seam 2 Remote Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/http/jboss_seam_exec.rb
Disclosure date: 2010-07-19
References: CVE-2010-1871, OSVDB-66881

Description:
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform
          4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression
          Language (EL) expressions, which allows remote attackers to execute arbitrary code
          via a crafted URL. This modules also has been tested successfully against IBM
          WebSphere 6.1 running on iSeries.

          NOTE: this is only a vulnerability when the Java Security Manager is not properly
          configured.
Metasploit Module: NETGEAR ProSafe Network Management System 300 Authenticated File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_auth_download.rb
Disclosure date: 2016-02-04
References: CVE-2016-1524, US-CERT-VU-777024, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear_nms_rce.txt, URL-https://seclists.org/fulldisclosure/2016/Feb/30

Description:
Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems.
          The application has a file download vulnerability that can be exploited by an
          authenticated remote attacker to download any file in the system.
          This module has been tested with versions 1.5.0.2, 1.4.0.17 and 1.1.0.13.
Metasploit Module: Tomcat Administration Tool Default Access
Type: auxiliary
Path: modules/auxiliary/admin/http/tomcat_administration.rb
Authors: Matteo Cantoni <goony[at]nothink.org>
References: URL-http://tomcat.apache.org/

Description:
Detect the Tomcat administration interface.  The administration interface is included in versions 5.5 and lower.
                        Port 8180 is the default for FreeBSD, 8080 for all others.
Metasploit Module: Cisco Smart Software Manager (SSM) On-Prem Account Takeover (CVE-2024-20419)
Type: auxiliary
Path: modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb
Disclosure date: 2024-07-20
References: CVE-2024-20419, URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy#vp, URL-https://www.0xpolar.com/blog/CVE-2024-20419

Description:
This module exploits an improper access control vulnerability in Cisco Smart Software Manager (SSM) On-Prem <= 8-202206. An unauthenticated remote attacker
          can change the password of any existing user, including administrative users.

Check method (fingerprinting):
begin
      @xsrf_token_value = xsrf_token_value
      @auth_token = auth_token(@xsrf_token_value)
      @reset_password = reset_password(@xsrf_token_value, @auth_token)
    rescue AuthTokenError, XsrfTokenError, ResetPasswordError => e
      return Exploit::CheckCode::Unknown("Check method failed: #{e.class}, #{e}")
    end

    return Exploit::CheckCode::Unknown('Unable to determine the version (xsrf_token_value missing).') unless @xsrf_token_value
    return Exploit::CheckCode::Unknown('Unable to determine the version (auth_token missing).') unless @auth_token
    return Exploit::CheckCode::Unknown('Unable to determine the version (reset_password failed).') unless @reset_password

    if @reset_password.key?('status')
      return Exploit::CheckCode::Appears('Password reset was successful, target is vulnerable')
    end

    Exploit::CheckCode::Unknown('Password reset status could not be determined')
  end
Metasploit Module: Control iD iDSecure Authentication Bypass (CVE-2023-6329)
Type: auxiliary
Path: modules/auxiliary/admin/http/idsecure_auth_bypass.rb
Disclosure date: 2023-11-27
References: CVE-2023-6329, URL-https://www.tenable.com/security/research/tra-2023-36

Description:
This module exploits an improper access control vulnerability (CVE-2023-6329) in Control iD iDSecure <= v4.7.43.0. It allows an
          unauthenticated remote attacker to compute valid credentials and to add a new administrative user to the web interface of the product.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'api/util/configUI')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    return Exploit::CheckCode::Unknown('Target did not return HTTP 401') unless res&.code == 401

    data = res.get_json_document
    version = data['Version']
    return Exploit::CheckCode::Unknown('Could not determine IDSecure version') if version.nil?

    print_status('Got version: ' + version)
    return Exploit::CheckCode::Safe("IDSecure version #{version} is not vulnerable") unless Rex::Version.new(version) <= Rex::Version.new('4.7.43.0')

    return Exploit::CheckCode::Appears("IDSecure version #{version} is vulnerable")
  end
Metasploit Module: GitStack Unauthenticated REST API Requests
Type: auxiliary
Path: modules/auxiliary/admin/http/gitstack_rest.rb
Disclosure date: 2018-01-15
References: CVE-2018-5955, EDB-43777, EDB-44044

Description:
This modules exploits unauthenticated REST API requests in GitStack through v2.3.10.
          The module supports requests for listing users of the application and listing
          available repositories. Additionally, the module can create a user and add the user
          to the application's repositories. This module has been tested against GitStack v2.3.10.
Metasploit Module: Wordpress POST SMTP Account Takeover
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_post_smtp_acct_takeover.rb
Disclosure date: 2024-01-10
References: CVE-2023-6875, URL-https://github.com/UlyssesSaicha/CVE-2023-6875/tree/main

Description:
The POST SMTP WordPress plugin prior to 2.8.7 is affected by a privilege
          escalation where an unauthenticated user is able to reset the password
          of an arbitrary user. This is done by requesting a password reset, then
          viewing the latest email logs to find the associated password reset email.

Check method (fingerprinting):
unless wordpress_and_online?
      return Msf::Exploit::CheckCode::Safe('Server not online or not detected as wordpress')
    end

    checkcode = check_plugin_version_from_readme('post-smtp', '2.8.7')
    if checkcode == Msf::Exploit::CheckCode::Safe
      return Msf::Exploit::CheckCode::Safe('POST SMTP version not vulnerable')
    end

    checkcode
  end
Metasploit Module: Fortra FileCatalyst Workflow SQL Injection (CVE-2024-5276)
Type: auxiliary
Path: modules/auxiliary/admin/http/fortra_filecatalyst_workflow_sqli.rb
Disclosure date: 2024-06-25
References: CVE-2024-5276, URL-https://www.tenable.com/security/research/tra-2024-25, URL-https://support.fortra.com/filecatalyst/kb-articles/advisory-6-24-2024-filecatalyst-workflow-sql-injection-vulnerability-YmYwYWY4OTYtNTUzMi1lZjExLTg0MGEtNjA0NWJkMDg3MDA0

Description:
This module exploits a SQL injection vulnerability in Fortra FileCatalyst Workflow <= v5.1.6 Build 135, by adding a new
          administrative user to the web interface of the application.
Metasploit Module: SysAid Help Desk Database Credentials Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/http/sysaid_sql_creds.rb
Disclosure date: 2015-06-03
References: CVE-2015-2996, CVE-2015-2998, URL-https://seclists.org/fulldisclosure/2015/Jun/8, URL-https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt

Description:
This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated
          user to download arbitrary files from the system. This is used to download the server
          configuration file that contains the database username and password, which is encrypted
          with a fixed, known key. This module has been tested with SysAid 14.4 on Windows and Linux.
Metasploit Module: Linksys WRT120N tmUnblock Stack Buffer Overflow
Type: auxiliary
Path: modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb
Disclosure date: 2014-02-19
References: CVE-2014-125122, EDB-31758, OSVDB-103521, URL-https://web.archive.org/web/[PII_REDACTED]3058/http://www.devttys0.com/2014/02/wrt120n-fprintf-stack-overflow/

Description:
This module exploits a stack-based buffer overflow vulnerability in the WRT120N Linksys router
          to reset the password of the management interface temporarily to an empty value.
          This module has been tested successfully on a WRT120N device with firmware version
          1.0.07.
Metasploit Module: Postfixadmin Protected Alias Deletion Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb
Platform: php
Disclosure date: 2017-02-03
References: CVE-2017-5930, URL-https://github.com/postfixadmin/postfixadmin/pull/23, BID-96142

Description:
Postfixadmin installations between 2.91 and 3.0.1 do not check if an
          admin is allowed to delete protected aliases. This vulnerability can be
          used to redirect protected aliases to an other mail address. Eg. rewrite
          the postmaster@domain alias.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => postfixadmin_url_login, 'method' => 'GET' })

    return Exploit::CheckCode::Unknown('No response received from the target') unless res

    return Exploit::CheckCode::Safe('Target did not return a 200 response') if res.code != 200

    if res.body =~ /<div id="footer".*Postfix Admin/m
      version = res.body.match(%r{<div id="footer"[^<]*<a[^<]*Postfix\s*Admin\s*([^<]*)</}mi)
      return Exploit::CheckCode::Detected('Postfix Admin detected but version could not be determined') unless version
      if Rex::Version.new('2.91') > Rex::Version.new(version[1])
        return Exploit::CheckCode::Detected("Postfix Admin #{version[1]} is older than the vulnerable range")
      elsif Rex::Version.new('3.0.1') < Rex::Version.new(version[1])
        return Exploit::CheckCode::Detected("Postfix Admin #{version[1]} is newer than the vulnerable range")
      end

      return Exploit::CheckCode::Appears("Postfix Admin #{version[1]} is in the vulnerable range 2.91-3.0.1")
    end

    return Exploit::CheckCode::Unknown('Could not identify Postfix Admin on the target')
  end
Metasploit Module: TYPO3 sa-2009-001 Weak Encryption Key File Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/http/typo3_sa_2009_001.rb
Disclosure date: Jan 20 2009
References: CVE-2009-0255, OSVDB-51536, URL-http://blog.c22.cc/advisories/typo3-sa-2009-001, URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/

Description:
This module exploits a flaw in TYPO3 encryption ey creation process to allow for
        file disclosure in the jumpUrl mechanism. This flaw can be used to read any file
        that the web server user account has access to view.
Metasploit Module: MantisBT password reset
Type: auxiliary
Path: modules/auxiliary/admin/http/mantisbt_password_reset.rb
Platform: win
Disclosure date: 2017-04-16
References: CVE-2017-7615, EDB-41890, URL-https://mantisbt.org/bugs/view.php?id=22690, URL-http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt

Description:
MantisBT before 1.3.10, 2.2.4, and 2.3.1 are vulnerable to unauthenticated password reset.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/login_page.php'),
      'method' => 'GET'
    })

    if res && res.body && res.body.include?('Powered by <a href="http://www.mantisbt.org" title="bug tracking software">MantisBT')
      vprint_status('MantisBT detected')
      return Exploit::CheckCode::Detected('MantisBT detected')
    else
      vprint_status('Not a MantisBT Instance!')
      return Exploit::CheckCode::Safe('Target does not appear to be MantisBT')
    end
  rescue Rex::ConnectionRefused
    print_error('Connection refused by server.')
    return Exploit::CheckCode::Safe('Connection refused by server')
  end
Metasploit Module: Linksys WRT54GL Remote Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
Disclosure date: 2013-01-18
References: CVE-2023-31742, URL-http://www.s3cur1ty.de/m1adv2013-01, URL-http://www.s3cur1ty.de/attacking-linksys-wrt54gl, EDB-24202, BID-57459, OSVDB-89421

Description:
Some Linksys Routers are vulnerable to OS Command injection.
          You will need credentials to the web interface to access the vulnerable part
          of the application.
          Default credentials are always a good starting point. admin/admin or admin
          and blank password could be a first try.
          Note: This is a blind OS command injection vulnerability. This means that
          you will not see any output of your command. Try a ping command to your
          local system and observe the packets with tcpdump (or equivalent) for a first test.

          Hint: To get a remote shell you could upload a netcat binary and exec it.
          WARNING: this module will overwrite network and DHCP configuration.
Metasploit Module: SAP Internet Graphics Server (IGS) XMLCHART XXE
Type: auxiliary
Path: modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe.rb
Disclosure date: 2018-03-14
References: CVE-2018-2392, CVE-2018-2393, URL-https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_IGS-The-vulnerable-forgotten-component.pdf

Description:
This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page
          of SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53. These
          vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when
          submitting a POST request to the XMLCHART page to generate a new chart.

          Successful exploitation will allow unauthenticated remote attackers to read files from the server as the user
          from which the IGS service is started, which will typically be the SAP admin user. Alternatively attackers
          can also abuse the XXE vulnerability to conduct a denial of service attack against the vulnerable
          SAP IGS server.

Check method (fingerprinting):
# Set up variables
    os_release = ''
    os_release_file = '/etc/os-release'

    # Set up XML data for HTTP request
    setup_xml_and_variables
    make_post_data(os_release_file, dos: false) # Create a XML data payload to retrieve the value of /etc/os-release
    # so that the module can check if the target is vulnerable or not.

    # Get OS release information
    check_response = send_first_request
    if check_response == -1
      Exploit::CheckCode::Safe('The server encountered an exception when trying to respond to the first request and did not respond in the expected manner.')
    elsif check_response == -2
      Exploit::CheckCode::Safe('The server sent a response but it was not in the expected format. The target is likely patched.')
    else
      if check_response == -3
        vprint_status("The SAP IGS server is vulnerable, but file: #{os_release_file} not found or not enough rights.")
      else
        result = analyze_first_response(check_response.body)

        # Handle all the odd cases where analyze_first_response may not return a success code, aka a return value of 0.
        if result == -1 || result == -3
          Exploit::CheckCode::Safe('The server did not respond to the second request in the expected manner and is therefore safe')
        elsif result == -2
          Exploit::CheckCode::Unknown('Some connection error occurred and it was not possible to determine if the server is vulnerable or not')
        end

        if !@file_content.to_s.empty
Metasploit Module: SAP Unauthenticated WebService User Creation
Type: auxiliary
Path: modules/auxiliary/admin/sap/cve_2020_6287_ws_add_user.rb
Disclosure date: 2020-07-14
References: CVE-2020-6287, URL-https://github.com/chipik/SAP_RECON, URL-https://www.onapsis.com/recon-sap-cyber-security-vulnerability, URL-https://us-cert.cisa.gov/ncas/alerts/aa20-195a

Description:
This module leverages an unauthenticated web service to submit a job which will create a user with a specified
          role. The job involves running a wizard. After the necessary action is taken, the job is canceled to avoid
          unnecessary system changes.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'uri' => normalize_uri(target_uri.path),
        'method' => 'GET',
        'vars_get' => { 'wsdl' => '' }
      }
    )

    return Exploit::CheckCode::Unknown('No response received from target') if res.nil?
    return Exploit::CheckCode::Safe('Unexpected HTTP status') unless res.code == 200
    return Exploit::CheckCode::Safe('Response is not XML') unless res.headers['Content-Type'].to_s.strip.start_with?('text/xml')

    xml = res.get_xml_document
    return Exploit::CheckCode::Safe('Response does not contain WSDL namespace') unless xml.namespaces['xmlns:wsdl'] == 'http://schemas.xmlsoap.org/wsdl/'
    return Exploit::CheckCode::Safe('CTCWebService not found in WSDL') if xml.xpath("//wsdl:definitions/wsdl:service[@name='CTCWebService']").empty?

    Exploit::CheckCode::Vulnerable('SAP NetWeaver CTCWebService WSDL endpoint is accessible')
  end
Metasploit Module: SAP ConfigServlet OS Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb
Disclosure date: 2012-11-01
References: OSVDB-92704, EDB-24963, URL-http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf

Description:
This module allows execution of operating system commands through the SAP
          ConfigServlet without any authentication.
Metasploit Module: SAP Management Console OSExecute
Type: auxiliary
Path: modules/auxiliary/admin/sap/sap_mgmt_con_osexec.rb
References: URL-http://blog.c22.cc

Description:
This module allows execution of operating system commands through the SAP
        Management Console SOAP Interface. A valid username and password must be
        provided.