deardaniel/secdata-raw huggingface dataset:
Metasploit Module: SmarterTools SmarterMail GUID File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/smartermail_guid_file_upload.rb
Platform: %w[unix linux
Disclosure date: 2025-10-09
References: URL-https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/, CVE-2025-52691
Targets: Unix Command, Windows Command

Description:
This module exploits a pre-auth remote code execution vulnerability in SmarterTools SmarterMail before version 100.0.9413.
          The endpoint /api/upload fails to sanitize the contextData POST parameter which can contain JSON data with a
          "guid" key that allows directory traversal. By leveraging this vulnerability, an unauthenticated attacker can
          upload a malicious ASPX web shell to the server's web root directory, leading to remote code execution.

Check method (fingerprinting):
check_version('100.0.9413')
  end
Metasploit Module: China Chopper Caidao PHP Backdoor Code Execution
Type: exploit
Path: modules/exploits/multi/http/caidao_php_backdoor_exec.rb
Platform: php
Disclosure date: 2015-10-27
Authors: Nixawk
References: URL-https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html, URL-https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html, URL-http://web.archive.org/web/[PII_REDACTED]0632/https://www.exploit-db.com/docs/27654.pdf, URL-https://www.cisa.gov/uscert/ncas/alerts/TA15-313A

Description:
This module takes advantage of the China Chopper Webshell that is
          commonly used by Chinese hackers.

Check method (fingerprinting):
flag = Rex::Text.rand_text_alpha(16)
    res = http_send_command("printf(\"#{flag}\");")
    if res && res.body =~ /#{flag}/m
      Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: HP SiteScope issueSiebelCmd Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/hp_sitescope_issuesiebelcmd.rb
Platform: win
Disclosure date: 2013-10-30
References: CVE-2013-4835, OSVDB-99230, BID-63478, ZDI-13-263
Targets: HP SiteScope 11.20 / Windows, HP SiteScope 11.20 / Linux

Description:
This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the
          APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the
          user to execute arbitrary commands without authentication. This module has been tested
          successfully on HP SiteScope 11.20 over Windows 2003 SP2, Windows 2008 and CentOS 6.5.

Check method (fingerprinting):
value = rand_text_alpha(rand(8..17))

    res = send_soap_request(value)

    if res and res.code == 500 and res.body.to_s =~ /Cmd Error: User and Password must be specified/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Jenkins ACL Bypass and Metaprogramming RCE
Type: exploit
Path: modules/exploits/multi/http/jenkins_metaprogramming.rb
Platform: unix
Disclosure date: 2019-01-08
References: CVE-2[PII_REDACTED], CVE-2[PII_REDACTED], CVE-2[PII_REDACTED], CVE-2[PII_REDACTED], CVE-2[PII_REDACTED], CVE-2[PII_REDACTED], EDB-46427, URL-https://jenkins.io/security/advisory/2019-01-08/, URL-https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html, URL-https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html
Targets: Unix In-Memory, Java Dropper

Description:
This module exploits a vulnerability in Jenkins dynamic routing to
          bypass the Overall/Read ACL and leverage Groovy metaprogramming to
          download and execute a malicious JAR file.

          When the "Java Dropper" target is selected, the original entry point
          based on classLoader.parseClass is used, which requires the use of
          Groovy metaprogramming to achieve RCE.

          When the "Unix In-Memory" target is selected, a newer, higher-level,
          and more universal entry point based on GroovyShell.parse is used.
          This permits the use of in-memory arbitrary command execution.

          The ACL bypass gadget is specific to Jenkins <= 2.137 and will not work
          on later versions of Jenkins.

          Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => go_go_gadget1('/search/index'),
      'vars_get' => { 'q' => 'a' }
    )

    unless res && (version = res.headers['X-Jenkins'])
      vprint_error('Jenkins version not detected')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    vprint_status("Jenkins #{version} detected")

    if Rex::Version.new(version) > target['Version']
      vprint_error("Jenkins #{version} is not a supported target")
      return CheckCode::Safe('The target is not running a vulnerable version')
    end

    vprint_good("Jenkins #{version} is a supported target")
    checkcode = CheckCode::Appears('The target is running a vulnerable version')

    if res.body.include?('Administrator')
      vprint_good('ACL bypass successful')
      checkcode = CheckCode::Vulnerable('Successfully verified the authentication bypass')
    else
      vprint_error('ACL bypass unsuccessful')
      return CheckCode::Safe('The target is not running a vulnerable version')
    end

    checkcode
  end
Metasploit Module: phpMyAdmin 3.5.2.2 server_sync.php Backdoor
Type: exploit
Path: modules/exploits/multi/http/phpmyadmin_3522_backdoor.rb
Platform: php
Disclosure date: 2012-09-25
References: CVE-2012-5159, OSVDB-85739, EDB-21834, URL-http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php

Description:
This module exploits an arbitrary code execution backdoor
          placed into phpMyAdmin v3.5.2.2 through a compromised SourceForge mirror.
Metasploit Module: Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/pandora_upload_exec.rb
Platform: php
Disclosure date: 2010-11-30
References: CVE-2010-4279, OSVDB-69549, BID-45112

Description:
This module exploits an authentication bypass vulnerability in Pandora FMS v3.1 as
          disclosed by Juan Galiana Lara. It also integrates with the built-in pandora
          upload which allows a user to upload arbitrary files to the '/images/' directory.

          This module was created as an exercise in the Metasploit Mastery Class at Blackhat
          that was facilitated by egypt and mubix.

Check method (fingerprinting):
base = target_uri.path

    # retrieve software version from login page
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(base, 'index.php')
      })
      if res and res.code == 200
        # Tested on v3.1 Build PC100609 and PC100608
        if res.body.include?("v3.1 Build PC10060")
          return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
        elsif res.body.include?("Pandora")
          return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
        end
      end
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    rescue ::Rex::ConnectionError
      vprint_error("Connection failed")
    end
    return Exploit::CheckCode::Unknown('Could not connect to the target')
  end

  # upload a payload using the pandora built-in file upload
Metasploit Module: VMware Hyperic HQ Groovy Script-Console Java Execution
Type: exploit
Path: modules/exploits/multi/http/hyperic_hq_script_console.rb
Platform: win
Disclosure date: 2013-10-10
References: URL-http://web.archive.org/web/[PII_REDACTED]5841/http://pubs.vmware.com/vfabric5/topic/com.vmware.vfabric.hyperic.4.6/ui-Groovy.html
Targets: Windows, Linux, Unix CMD

Description:
This module uses the VMware Hyperic HQ Groovy script console to execute
          OS commands using Java. Valid credentials for an application administrator
          user account are required. This module has been tested successfully with
          Hyperic HQ 4.6.6 on Windows 2003 SP2 and Ubuntu 10.04 systems.

Check method (fingerprinting):
@uri = target_uri
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']

    # login
    vprint_status("Authenticating as '#{user}'")
    res = login(user, pass)
    if res and res.code == 302 and res.headers['location'] !~ /authfailed/
      vprint_good("Authenticated successfully as '#{user}'")
      # check access to the console
      vprint_status("Checking access to the script console")
      get_nonce
      if @nonce.nil?
        return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
      else
        return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
      end
    elsif res.headers.include?('X-Jenkins') or res.headers['location'] =~ /authfailed/
      vprint_error("Authentication failed")
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: MaraCMS Arbitrary PHP File Upload
Type: exploit
Path: modules/exploits/multi/http/maracms_upload_exec.rb
Platform: php
Disclosure date: 2020-08-31
References: CVE-2020-25042, EDB-48780
Targets: PHP, Linux, Windows

Description:
This module exploits an arbitrary file upload vulnerability in
          MaraCMS 7.5 and prior in order to execute arbitrary commands.

          The module first attempts to authenticate to MaraCMS. It then tries
          to upload a malicious PHP file to the web root via an HTTP POST
          request to `codebase/handler.php.` If the `php` target is selected,
          the payload is embedded in the uploaded file and the module attempts
          to execute the payload via an HTTP GET request to this file. For the
          `linux` and `windows` targets, the module uploads a simple PHP web
          shell similar to `<?php system($_GET["cmd"]); ?>`. Subsequently, it
          leverages the CmdStager mixin to deliver the final payload via a
          series of HTTP GET requests to the PHP web shell.

          Valid credentials for a MaraCMS `admin` or `manager` account are
          required. This module has been successfully tested against MaraCMS
          7.5 running on Windows Server 2012 (XAMPP server).

Check method (fingerprinting):
vprint_status('Running check')

    # visit /about.php to obtain MaraCMS version and cookies
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'about.php'),
      'keep_cookies' => true
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200 && res.body.include?('Mara cms')
      return CheckCode::Safe('Target is not a MaraCMS application.')
    end

    html = res.get_html_document
    version_header = html.css('h1').text # obtain the h1 text, which for MaraCMS 7.5 is `Version 7.2 :: Production release`
    version = version_header.split(' ')[1] # grab the version number

    if version.blank?
      return CheckCode::Detected('Could not determine MaraCMS version.')
    end

    version = Rex::Version.new version

    unless version <= Rex::Version.new('7.2') # 7.2 is the version listed on the about page for MaraCMS 7.5
      # MaraCMS no longer seems to be maintained, but the check below is added in case they every update it
      return CheckCode::Safe('Target is likely MaraCMS with a version higher than 7.5 and may not be vulnerable.')
    end

    return CheckCode::Appears('Target is most likely MaraCMS with version 7.5 or lower')
  end
Metasploit Module: Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE
Type: exploit
Path: modules/exploits/multi/http/atlassian_crowd_pdkinstall_plugin_upload_rce.rb
Platform: java
Disclosure date: 2019-05-22
References: CVE-2019-11580, URL-https://jira.atlassian.com/browse/CWD-5388, URL-https://confluence.atlassian.com/crowd/crowd-security-advisory-2019-05-22-970260700.html, URL-https://www.corben.io/atlassian-crowd-rce/
Targets: Java Universal

Description:
This module can be used to upload a plugin on Atlassian Cloud via
          the pdkinstall development plugin as an unauthenticated attacker.
          The payload is uploaded as a JAR archive containing a servlet using
          a POST request to /crowd/admin/uploadplugin.action. The check command will
          check that the /crowd/admin/uploadplugin.action page exists and that it
          responds appropriately to determine if the target is vulnerable or not.

Check method (fingerprinting):
print_status('Sending a test request to try installing an invalid plugin to see if the server is vulnerable...')
    res = upload_plugin(Rex::Text.rand_text_alpha(45..120))
    if res.nil?
      CheckCode::Unknown('Was not able to connect to the target!')
    elsif (res.body =~ /Unable to install plugin/) && (res.code == 400)
      CheckCode::Vulnerable("Target responded that it couldn't install an invalid plugin, indicating it's vulnerable!")
    else
      CheckCode::Safe("Target didn't respond that it couldn't install an invalid plugin, so it's not vulnerable!")
    end
  end
Metasploit Module: ActiveMQ web shell upload
Type: exploit
Path: modules/exploits/multi/http/apache_activemq_upload_jsp.rb
Platform: java
Disclosure date: 2016-06-01
References: CVE-2016-3088, URL-http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
Targets: Java Universal, Linux, Windows

Description:
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0
          allows remote attackers to upload and execute arbitrary files via an
          HTTP PUT followed by an HTTP MOVE request.
Metasploit Module: JetBrains TeamCity Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2023_42793.rb
Platform: win
Disclosure date: 2023-09-19
References: CVE-2023-42793, URL-https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis, URL-https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/

Description:
This module exploits an authentication bypass vulnerability to achieve unauthenticated remote code execution
          against a vulnerable JetBrains TeamCity server. All versions of TeamCity prior to version 2023.05.4 are
          vulnerable to this issue. The vulnerability was originally discovered by SonarSource.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/login.html'
    )

    return CheckCode::Unknown('Connection failed') unless res

    # We expect a TeamCity server to respond with either a "TeamCity-Node-Id" header value or a cookie named "TCSESSIONID".
    # In the responses HTML body will be a string containing the release name and build version.
    if (res.headers.key?('TeamCity-Node-Id') || res.get_cookies.include?('TCSESSIONID')) && (res.body =~ /(\d+\.\d+\.\d+) \(build (\d+)\)/)
      detected = "JetBrains TeamCity #{::Regexp.last_match(1)} (build #{::Regexp.last_match(2)}) detected."

      # The vulnerability was patched in release 2023.05.4 (build 129421) so anything before this build is vulnerable.
      if ::Regexp.last_match(2).to_i < 129421
        return CheckCode::Vulnerable(detected)
      end

      return CheckCode::Safe(detected)
    end

    CheckCode::Unknown('Could not connect to the target')
  end
Metasploit Module: PhpTax pfilez Parameter Exec Remote Code Injection
Type: exploit
Path: modules/exploits/multi/http/phptax_exec.rb
Platform: %w{linux unix}
Disclosure date: 2012-10-08
References: CVE-2012-10037, OSVDB-86992, EDB-21665

Description:
This module exploits a vulnerability found in PhpTax, an income tax report
          generator.  When generating a PDF, the icondrawpng() function in drawimage.php
          does not properly handle the pfilez parameter, which will be used in an exec()
          statement, and then results in arbitrary remote code execution under the context
          of the web server.  Please note: authentication is not required to exploit this
          vulnerability.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    res = send_request_raw({ 'uri' => uri })
    if res and res.body =~ /PHPTAX by William L\. Berggren/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: SPIP form PHP Injection
Type: exploit
Path: modules/exploits/multi/http/spip_rce_form.rb
Platform: php
Disclosure date: 2023-02-27
References: URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html, URL-https://therealcoiffeur.com/c11010, CVE-2023-27372
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a PHP code injection in SPIP. The vulnerability exists in the
          oubli parameter and allows an unauthenticated user to execute arbitrary commands
          with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions
          are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.

Check method (fingerprinting):
rversion = spip_version || spip_plugin_version('spip')
    return Exploit::CheckCode::Unknown('Unable to determine the version of SPIP') unless rversion

    print_status("SPIP Version detected: #{rversion}")

    vulnerable_ranges = [
      { start: Rex::Version.new('4.2.0'), end: Rex::Version.new('4.2.1') },
      { start: Rex::Version.new('4.1.0'), end: Rex::Version.new('4.1.18') },
      { start: Rex::Version.new('4.0.0'), end: Rex::Version.new('4.0.10') },
      { start: Rex::Version.new('3.2.0'), end: Rex::Version.new('3.2.18') }
    ]

    vulnerable_ranges.each do |range|
      if rversion.between?(range[:start], range[:end])
        return Exploit::CheckCode::Appears("The detected SPIP version (#{rversion}) is vulnerable.")
      end
    end

    return Exploit::CheckCode::Safe("The detected SPIP version (#{rversion}) is not vulnerable.")
  end
Metasploit Module: Apache Flink JAR Upload Java Code Execution
Type: exploit
Path: modules/exploits/multi/http/apache_flink_jar_upload_exec.rb
Platform: java
Disclosure date: 2019-11-13
References: EDB-48978, URL-https://github.com/biggerwing/apache-flink-unauthorized-upload-rce-, URL-https://s.tencent.com/research/bsafe/841.html, URL-https://cloud.tencent.com/developer/article/1540439, URL-https://nsfocusglobal.com/advisory-apache-flink-remote-code-execution-vulnerability/

Description:
This module uses job functionality in Apache Flink dashboard web
          interface to upload and execute a JAR file, leading to remote
          execution of arbitrary Java code as the web server user.

          This module has been tested successfully on Apache Flink versions:
          1.9.3 on Ubuntu 18.04.4;
          1.11.2 on Ubuntu 18.04.4;
          1.9.3 on Windows 10; and
          1.11.2 on Windows 10.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'config')
    })

    unless res
      return CheckCode::Unknown('No reply.')
    end

    unless res.body.include?('flink')
      return CheckCode::Safe('Target is not Apache Flink.')
    end

    version = res.get_json_document['flink-version']
    if version
      return CheckCode::Appears("Apache Flink version #{version}.")
    end

    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: Cacti RCE via SQLi in pollers.php
Type: exploit
Path: modules/exploits/multi/http/cacti_pollers_sqli_rce.rb
Disclosure date: 2023-12-20
References: CVE-2023-49085, CVE-2023-49084
Targets: Linux Command, Windows Command

Description:
This exploit module leverages a SQLi (CVE-2023-49085) and a LFI
          (CVE-2023-49084) vulnerability in Cacti versions prior to 1.2.26 to
          achieve RCE. Authentication is needed and the account must have access
          to the vulnerable PHP script (`pollers.php`). This is granted by
          setting the `Sites/Devices/Data` permission in the `General
          Administration` section.

Check method (fingerprinting):
# Step 1 - Check if the target is Cacti and get the version
    print_status('Checking Cacti version')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?

    html = res.get_html_document
    begin
      @cacti_version = parse_version(html)
      version_msg = "The web server is running Cacti version #{@cacti_version}"
    rescue CactiNotFoundError => e
      return CheckCode::Safe(e.message)
    rescue CactiVersionNotFoundError => e
      return CheckCode::Unknown(e.message)
    end

    if Rex::Version.new(@cacti_version) < Rex::Version.new('1.2.26')
      print_good(version_msg)
    else
      return CheckCode::Safe(version_msg)
    end

    # Step 2 - Login
    @csrf_token = parse_csrf_token(html)
    return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty?

    begin
      do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token)
    rescue CactiError => e
      return CheckCode::Unknown("Login failed: #{e}")
    end

    @logged_in = true

    # Step 3 - Check if the user has enough permissions to reach `pollers.php`
    print_status('Checking permissions to access `pollers.php`')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'pollers.php'),
      'method' => 'GET',
      'keep_cookies' => tru
Metasploit Module: Nibbleblog File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/nibbleblog_file_upload.rb
Platform: php
Disclosure date: 2015-09-01
References: CVE-2015-6967, URL-https://curesec.com/blog/article/blog/NibbleBlog-403-Code-Execution-47.html

Description:
Nibbleblog contains a flaw that allows an authenticated remote
          attacker to execute arbitrary PHP code. This module was
          tested on version 4.0.3.

Check method (fingerprinting):
cookie = do_login(username, password)
    return Exploit::CheckCode::Detected('The target application was detected but requires authentication') unless cookie

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin.php'),
      'cookie' => cookie,
      'vars_get' => {
        'controller' => 'settings',
        'action' => 'general'
      }
    )

    if res && res.code == 200 && res.body.include?('Nibbleblog 4.0.3 "Coffee"')
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end