deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Flowmon Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/progress_flowmon_unauth_cmd_injection.rb
Platform: unix
Disclosure date: 2024-04-23
References: CVE-2024-2389, URL-https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/, URL-https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8733-CVE-2024-2389-Flowmon-critical-security-vulnerability

Description:
This module exploits an unauthenticated command injection vulnerability in Progress Flowmon
          versions before v12.03.02.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited!")

    uri = normalize_uri(target_uri.path, 'homepage/auth/login')
    res = send_request_cgi(
      'uri' => uri,
      'method' => 'GET'
    )

    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Safe('Target does not appear to be running Progress Flowmon') unless res.code == 200 && res.get_html_document.xpath('//title').text == 'Flowmon Web Interface'

    # Use a regular expression to extract the version number from the response
    version = res.body.match(%r{/favicon\.ico\?v=([\d.]+)})

    return CheckCode::Unknown('Unable to determine the version from the favicon link.') unless version && version[1]

    print_status("Detected version: #{version[1]}")

    if Rex::Version.new(version[1]) <= Rex::Version.new('12.03.02')
      CheckCode::Vulnerable("Version #{version[1]} is vulnerable.")
    else
      CheckCode::Safe("Version #{version[1]} is not vulnerable.")
    end
  end
Metasploit Module: TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/trueonline_p660hn_v2_rce.rb
Platform: linux
Disclosure date: 2016-12-26
References: CVE-2017-18370, CVE-2017-18371, URL-https://seclists.org/fulldisclosure/2017/Jan/40, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt, URL-https://blogs.securiteam.com/index.php/archives/2910

Description:
TrueOnline is a major ISP in Thailand, and it distributes a customized version of
          the ZyXEL P660HN-T v2 router. This customized version has an authenticated command injection
          vulnerability in the remote log forwarding page. This can be exploited using the "supervisor"
          account that comes with a default password on the device.
          This module was tested in an emulated environment, as the author doesn't have access to the
          Thai router any more. Any feedback should be sent directly to the module's author, as well as
          to the Metasploit project. Note that the inline payloads work best.
          There are Turkish and other language strings in the firmware, so it is likely that this
          firmware is not only distributed in Thailand. Other P660HN-T v2 in other countries might be
          vulnerable too.

Check method (fingerprinting):
res = send_request_cgi!({
      'uri' => '/js/Multi_Language.js',
      'method' => 'GET'
    })
    if res && res.body =~ /P-660HN-T1A_IPv6/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: DC/OS Marathon UI Docker Exploit
Type: exploit
Path: modules/exploits/linux/http/dcos_marathon.rb
Platform: python
Disclosure date: 2017-03-03
Authors: Erik Daguerre
References: CVE-2017-20198, URL-https://warroom.securestate.com/dcos-marathon-compromise/
Targets: Python

Description:
Utilizing the DCOS Cluster's Marathon UI, an attacker can create
          a docker container with the '/' path mounted with read/write
          permissions on the host server that is running the docker container.
          As the docker container executes command as uid 0 it is honored
          by the host operating system allowing the attacker to edit/create
          files owed by root. This exploit abuses this to creates a cron job
          in the '/etc/cron.d/' path of the host server.

          *Notes: The docker image must be a valid docker image from
          hub.docker.com. Furthermore the docker container will only
          deploy if there are resources available in the DC/OS cluster.

Check method (fingerprinting):
return Exploit::CheckCode::Safe('The target is not vulnerable') if get_apps.nil?

    Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: Linear eMerge E3-Series Access Controller Command Injection
Type: exploit
Path: modules/exploits/linux/http/linear_emerge_unauth_rce_cve_2019_7256.rb
Platform: unix
Disclosure date: 2019-10-29
References: CVE-2019-7256, URL-https://applied-risk.com/resources/ar-2019-005, URL-https://na.niceforyou.com/, URL-https://attackerkb.com/topics/8WUJkci8N4/cve-2019-7256, EDB-47649
Targets: Unix Command, Linux Dropper

Description:
This module exploits a command injection vulnerability in the Linear eMerge
          E3-Series Access Controller. The Linear eMerge E3 versions `1.00-06` and below are vulnerable
          to unauthenticated command injection in card_scan_decoder.php via the  `No` and `door` HTTP GET parameter.
          Successful exploitation results in command execution as the `root` user.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    sleep_time = rand(2..10)
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end

    return CheckCode::Unknown('No response received from the target!') unless res
    return CheckCode::Safe('Target is not affected by this vulnerability.') unless res.code == 200 && !res.body.blank? && res.body =~ /"card_format_default":"/

    print_status("Elapsed time: #{elapsed_time.round(2)} seconds.")
    return CheckCode::Safe('Command injection test failed.') unless elapsed_time >= sleep_time

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection
Type: exploit
Path: modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_37404.rb
Platform: linux
Disclosure date: 2024-10-08
References: CVE-2024-37404, URL-https://attackerkb.com/topics/FI5vcuGwyM/cve-2024-37404, URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-and-Policy-Secure-CVE-2024-37404, URL-https://blog.amberwolf.com/blog/2024/october/cve-2024-37404-ivanti-connect-secure-authenticated-rce-via-openssl-crlf-injection/

Description:
This module exploits a CRLF injection vulnerability in Ivanti Connect
          Secure to achieve remote code execution (CVE-2024-37404). Versions
          prior to 22.7R2.1 are vulnerable. Note that Ivanti Policy Secure
          versions prior to 22.7R1.1 are also vulnerable but this module
          doesn't support this software.

          Valid administrative credentials are required. A non-administrative
          user is also required and can be created using the administrative
          account, if needed.

Check method (fingerprinting):
begin
      login_admin
      @logged = true
    rescue IvantiError => e
      return CheckCode::Unknown("Unable to login to the administrative interface: #{e}")
    end

    begin
      version = get_version
    rescue IvantiError => e
      return CheckCode::Detected("Version number not found: #{e}")
    end

    unless version < Rex::Version.new('22.7R2.1')
      return CheckCode::Safe("Version number: #{version}")
    end

    return CheckCode::Appears("Version #{version} appears to be vulnerable")
  end
Metasploit Module: Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload
Type: exploit
Path: modules/exploits/linux/http/oracle_ebs_rce_cve_2022_21587.rb
Platform: linux
Disclosure date: 2022-10-01
References: CVE-2022-21587, URL-https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis, URL-https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/, URL-https://github.com/hieuminhnv/CVE-2022-21587-POC

Description:
This module exploits an unauthenticated arbitrary file upload vulnerability in Oracle Web Applications
          Desktop Integrator, as shipped with Oracle EBS versions 12.2.3 through to 12.2.11, in
          order to gain remote code execution as the oracle user.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/OA_HTML/FrmReportData'
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown('Could not determine the target status') unless res.code == 200

    match = res.body.match(%r{jsLibs/Common(\d+_\d+_\d+)})

    if match && (match.length == 2)
      version = Rex::Version.new(match[1].gsub('_', '.'))

      if version.between?(Rex::Version.new('12.2.3'), Rex::Version.new('12.2.11'))
        return CheckCode::Appears("Oracle EBS version #{version} detected.")
      end

      return CheckCode::Safe("Oracle EBS version #{version} detected.")
    end

    CheckCode::Unknown('Oracle EBS detected, but the version could not be determined')
  end
Metasploit Module: Ivanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457.rb
Platform: linux
Disclosure date: 2025-04-03
References: CVE-2025-22457, URL-https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457, URL-https://attackerkb.com/topics/0ybGQIkHzR/cve-2025-22457/rapid7-analysis, URL-https://github.com/sfewer-r7/CVE-2025-22457
Targets: Unix/Linux Command Shell

Description:
This module exploits a Stack-based Buffer Overflow vulnerability in
          Ivanti Connect Secure to achieve remote code execution
          (CVE-2025-22457). Versions 22.7R2.5 and earlier are vulnerable. Note
          that Ivanti Pulse Connect Secure, Ivanti Policy Secure and ZTA gateways
          are also vulnerable but this module doesn't support this software. Heap
          spray is used to place our payload in memory at a predetermined
          location. Due to ASLR, the base address of `libdsplibs` is unknown.
          This library is used by the exploit to build a ROP chain and get
          command execution. As a result, the module will brute force this
          address starting from  the address set by the `LIBDSPLIBS_ADDRESS`
          option.

Check method (fingerprinting):
print_status("Checking the product version for #{url_schema}://#{rhost}:#{rport}")

    # This has been fixed in version 22.7R2.6, which corresponds to 22.7.2 (build 3981)
    # see https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.7R2/22.xICSRN.pdf
    if Rex::Version.new(product_version) < Rex::Version.new('22.7.2.3981')
      return CheckCode::Appears("Detected version: #{product_version}")
    end

    CheckCode::Safe("Detected version: #{product_version}")
  rescue IvantiError => e
    CheckCode::Unknown("Unknown version: #{e}")
  end
Metasploit Module: HP VAN SDN Controller Root Command Injection
Type: exploit
Path: modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb
Platform: unix
Disclosure date: 2018-06-25
References: EDB-44951, URL-https://korelogic.com/Resources/Advisories/KL-001-2018-008.txt
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits a hardcoded service token or default credentials
          in HPE VAN SDN Controller <= 2.7.18.0503 to execute a payload as root.

          A root command injection was discovered in the uninstall action's name
          parameter, obviating the need to use sudo for privilege escalation.

          If the service token option TOKEN is blank, USERNAME and PASSWORD will
          be used for authentication. An additional login request will be sent.

Check method (fingerprinting):
checkcode = CheckCode::Safe('The target is not vulnerable')

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => '/',
      'headers' => { 'X-Auth-Token' => auth_token },
      'ctype' => 'application/json',
      'data' => { 'action' => 'uninstall' }.to_json
    )

    if res.nil?
      checkcode = CheckCode::Unknown('Could not determine the target status')
    elsif res && res.code == 400 && res.body.include?('Missing field: name')
      checkcode = CheckCode::Appears('The target appears to be vulnerable')
    elsif res && res.code == 401 && res.body =~ /Missing|Invalid token/
      checkcode = CheckCode::Safe('The target is not vulnerable')
    end

    checkcode
  end
Metasploit Module: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
Disclosure date: 2024-12-16
References: CVE-2024-12356, CVE-2025-1094, URL-http://web.archive.org/web/[PII_REDACTED]4006/https://www.beyondtrust.com/trust-center/security-advisories/bt24-10, URL-https://www.postgresql.org/support/security/CVE-2025-1094/, URL-https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis

Description:
This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote
          Access (PRA) and Remote Support (RS), with the privileges of the site user of the targeted BeyondTrust
          product site. This exploit targets PRA and RS versions 24.3.1 and below.

Check method (fingerprinting):
product_version = get_version
    return CheckCode::Unknown('Could not determine the target status') unless product_version

    product_version = Rex::Version.new(product_version)
    if Rex::Version.new(product_version) <= Rex::Version.new('24.3.1')
      return CheckCode::Appears("Detected version #{product_version}")
    end

    CheckCode::Safe("Version #{product_version} is not vulnerable")
  end
Metasploit Module: Chamilo unauthenticated command injection in PowerPoint upload
Type: exploit
Path: modules/exploits/linux/http/chamilo_unauth_rce_cve_2023_34960.rb
Platform: php
Disclosure date: 2023-06-01
References: CVE-2023-34960, URL-https://www.randorisec.fr/pt/chamilo-1.11.18-multiple-vulnerabilities, URL-https://attackerkb.com/topics/VVJpMeSpUP/cve-2023-34960
Targets: PHP, Unix Command, Linux Dropper

Description:
Chamilo is an e-learning platform, also called Learning Management Systems (LMS).
          This module exploits an unauthenticated remote command execution vulnerability
          that affects Chamilo versions `1.11.18` and below (CVE-2023-34960).
          Due to a functionality called Chamilo Rapid to easily convert PowerPoint
          slides to courses on Chamilo, it is possible for an unauthenticated remote
          attacker to execute arbitrary commands at OS level using a malicious SOAP
          request at the vulnerable endpoint `/main/webservices/additional_webservices.php`.

Check method (fingerprinting):
# Checking if the target is vulnerable by echoing a randomised marker that will return the marker in the response.
    print_status("Checking if #{peer} can be exploited.")
    marker = Rex::Text.rand_text_alphanumeric(8..16)
    res = execute_command("echo #{marker}")
    if res && res.code == 200 && res.body.include?('wsConvertPptResponse') && res.body.include?(marker)
      CheckCode::Vulnerable('The target is vulnerable')
    else
      CheckCode::Safe('No valid response received from the target.')
    end
  end
Metasploit Module: Unraid 6.8.0 Auth Bypass PHP Code Execution
Type: exploit
Path: modules/exploits/linux/http/unraid_auth_bypass_exec.rb
Platform: php
Disclosure date: 2020-02-10
References: CVE-2020-5847, CVE-2020-5849, URL-http://web.archive.org/web/[PII_REDACTED]5905/https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/, URL-http://web.archive.org/web/[PII_REDACTED]0936/https://forums.unraid.net/topic/88253-critical-security-vulnerabilies-discovered/

Description:
This module exploits two vulnerabilities affecting Unraid 6.8.0.
          An authentication bypass is used to gain access to the administrative
          interface, and an insecure use of the extract PHP function can be abused
          for arbitrary code execution as root.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'webGui/images/green-on.png/'),
      'method' => 'GET'
    )

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 200
      return CheckCode::Safe('Unexpected reply')
    end

    /\sVersion:\s(?<version>\d{1,2}\.\d{1,2}\.\d{1,2})&nbsp;/ =~ res.body

    if version && Rex::Version.new(version) == Rex::Version.new('6.8.0')
      return CheckCode::Appears("Unraid version #{version} appears to be vulnerable")
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Acronis Cyber Infrastructure default password remote code execution
Type: exploit
Path: modules/exploits/linux/http/acronis_cyber_infra_cve_2023_45249.rb
Platform: unix
Disclosure date: 2024-07-24
References: CVE-2023-45249, URL-https://security-advisory.acronis.com/advisories/SEC-6452, URL-https://attackerkb.com/topics/T2b62daDsL/cve-2023-45249
Targets: Unix/Linux Command

Description:
Acronis Cyber Infrastructure (ACI) is an IT infrastructure solution that provides storage,
          compute, and network resources. Businesses and Service Providers are using it for data storage,
          backup storage, creating and managing virtual machines and software-defined networks, running
          cloud-native applications in production environments.
          This module exploits a default password vulnerability in ACI which allow an attacker to access
          the ACI PostgreSQL database and gain administrative access to the ACI Web Portal.
          This opens the door for the attacker to upload SSH keys that enables root access
          to the appliance/server. This attack can be remotely executed over the WAN as long as the
          PostgreSQL and SSH services are exposed to the outside world.
          ACI versions 5.0 before build 5.0.1-61, 5.1 before build 5.1.1-71, 5.2 before build 5.2.1-69,
          5.3 before build 5.3.1-53, and 5.4 before build 5.4.4-132 are vulnerable.

Check method (fingerprinting):
version_release = get_aci_version
    return CheckCode::Unknown('Could not retrieve the version information.') if version_release.nil?
    return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.0.1-61')

    case version_release.split(/\.\d-/)[0]
    when '5.0'
      return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.0.1-61')
    when '5.1'
      return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.1.1-71')
    when '5.2'
      return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.2.1-69')
    when '5.3'
      return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.3.1-53')
    when '5.4'
      return CheckCode::Appears("Version #{version_release}") if Rex::Version.new(version_release) < Rex::Version.new('5.4.4-132')
    end
    CheckCode::Safe("Version #{version_release}")
  end
Metasploit Module: VMware View Planner Unauthenticated Log File Upload RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb
Platform: python
Disclosure date: 2021-03-02
References: CVE-2021-21978, URL-http://web.archive.org/web/[PII_REDACTED]3557/https://www.vmware.com/security/advisories/VMSA-2021-0003.html, URL-https://attackerkb.com/assessments/fc456e03-adf5-409a-955a-8a4fb7e79ece
Targets: VMware View Planner 4.6.0

Description:
This module exploits an unauthenticated log file upload within the
          log_upload_wsgi.py file of VMWare View Planner 4.6 prior to 4.6
          Security Patch 1.

          Successful exploitation will result in RCE as the apache user inside
          the appacheServer Docker container.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'wsgi_log_upload', 'log_upload_wsgi.py')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && !res.body.empty?
      return CheckCode::Safe('log_upload_wsgi.py file not found at the expected location.')
    end

    @original_content = res.body # If the server responded with the contents of log_upload_wsgi.py, lets save this for later restoration.

    if res.body&.include?('import hashlib') && res.body.include?('if hashlib.sha256(password.value.encode("utf8")).hexdigest()==secret_key:')
      return CheckCode::Safe("Target's log_upload_wsgi.py file has been patched.")
    end

    CheckCode::Appears('Vulnerable log_upload_wsgi.py file identified!')
  end

  # We need to upload a file twice: once for uploading the backdoor, and once for restoring the original file.
  # As the code for both is the same, minus the content of the file, this is a generic function to handle that.
Metasploit Module: UnRAR Path Traversal in Zimbra (CVE-2022-30333)
Type: exploit
Path: modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb
Platform: linux
Disclosure date: 2022-06-28
References: CVE-2022-30333, URL-https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/, URL-https://github.com/pmachapman/unrar/commit/22b52431a0581ab5d687747b65662f825ec03946, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P25, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P32, URL-https://attackerkb.com/topics/RCa4EIZdbZ/cve-2022-30333/rapid7-analysis

Description:
This module creates a RAR file that can be emailed to a Zimbra server
          to exploit CVE-2022-30333. If successful, it plants a JSP-based
          backdoor in the public web directory, then executes that backdoor.

          The core vulnerability is a path-traversal issue in unRAR that can
          extract an arbitrary file to an arbitrary location on a Linux system.

          This issue is exploitable on the following versions of Zimbra, provided
          UnRAR version 6.11 or earlier is installed:

          * Zimbra Collaboration 9.0.0 Patch 24 (and earlier)
          * Zimbra Collaboration 8.8.15 Patch 31 (and earlier)