deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Unauthenticated RCE in React Server Components (React2Shell)
Type: exploit
Path: modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb
Platform: %w[unix linux
Disclosure date: 2025-12-03
References: CVE-2025-55182, CVE-2025-66478, URL-https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components, URL-https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3, URL-https://www.vulncheck.com/blog/react2shell-beyond-nextjs

Description:
A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in React Server
          Components (RSC) Flight protocol. The vulnerability allows attackers to achieve prototype
          pollution during deserialization of RSC payloads by sending specially crafted multipart
          requests with "__proto__", "constructor", or "prototype" as module names.

          This module supports multiple vulnerable frameworks including Next.js and Waku.

Check method (fingerprinting):
send(framework_config[:check_method])
  end
Metasploit Module: MediaWiki SyntaxHighlight extension option injection vulnerability
Type: exploit
Path: modules/exploits/multi/http/mediawiki_syntaxhighlight.rb
Platform: php
Disclosure date: 2017-04-06
Authors: Yorick Koster
References: CVE-2017-0372, URL-https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html, URL-https://phabricator.wikimedia.org/T158689, URL-https://securify.nl/advisory/SFY20170201/syntaxhighlight_mediawiki_extension_allows_injection_of_arbitrary_pygments_options.html

Description:
This module exploits an option injection vulnerability in the SyntaxHighlight
          extension of MediaWiki. It tries to create & execute a PHP file in the document root.
          The USERNAME & PASSWORD options are only needed if the Wiki is configured as private.

          This vulnerability affects any MediaWiki installation with SyntaxHighlight version 2.0
          installed & enabled. This extension ships with the AIO package of MediaWiki version
          1.27.x & 1.28.x. A fix for this issue is included in MediaWiki version 1.28.2 and
          version 1.27.3.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api.php'),
      'cookie' => @cookie,
      'vars_post' => {
        'action' => 'parse',
        'format' => 'json',
        'contentmodel' => 'wikitext',
        'text' => '<syntaxhighlight lang="java" start="0,full=1"></syntaxhighlight>'
      }
    })

    if (res && res.headers.key?('MediaWiki-API-Error'))
      if (res.headers['MediaWiki-API-Error'] == 'internal_api_error_MWException')
        return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
      elsif (res.headers['MediaWiki-API-Error'] == 'readapidenied')
        print_error("Login is required")
      end

      return Exploit::CheckCode::Unknown("MediaWiki API returned an error: #{res.headers['MediaWiki-API-Error']}")
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  # use deprecated interface
Metasploit Module: SugarCRM unauthenticated Remote Code Execution (RCE)
Type: exploit
Path: modules/exploits/multi/http/sugarcrm_webshell_cve_2023_22952.rb
Platform: php
Disclosure date: 2022-12-28
References: CVE-2023-22952, URL-https://seclists.org/fulldisclosure/2022/Dec/31, URL-https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/, URL-https://sugarclub.sugarcrm.com/engage/b/sugar-news/posts/jan-5-2023-security-vulnerability-update, URL-https://attackerkb.com/topics/E486ui94II/cve-2023-22952
Targets: PHP, Unix Command, Linux Dropper

Description:
This module exploits CVE-2023-22952, a Remote Code Execution (RCE) vulnerability in SugarCRM 11.0 Enterprise,
          Professional, Sell, Serve, and Ultimate versions prior to 11.0.5 and SugarCRM 12.0 Enterprise, Sell, and
          Serve versions prior to 12.0.2.

          The vulnerability occurs due to a lack of appropriate validation when uploading a malicious PNG file with
          embedded PHP code to the /cache/images/ directory on the web server using the vulnerable endpoint
          /index.php?module=EmailTemplates&action=AttachFiles. Once uploaded to the server, depending on server configuration,
          the attacker can access the malicious PNG file via HTTP or HTTPS, thereby executing the malicious PHP code and
          gaining access to the system.

          This vulnerability does not require authentication because there is a missing authentication check in the
          loadUser() method in include/MVC/SugarApplication.php. After a failed login, the session does not get
          destroyed and hence the attacker can continue to send valid requests to the application.

          Because of this, any remote attacker, regardless of authentication, can exploit this vulnerability to gain
          access to the underlying operating system as the user that the web services are running as (typically www-data).
Metasploit Module: Oracle E-Business Suite CVE-2025-61882 RCE
Type: exploit
Path: modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
Platform: %w[unix linux
Disclosure date: 2025-10-04
References: CVE-2025-61882, URL-https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/, URL-https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
Targets: Linux/Unix (Interactive Shell), Windows (Interactive Shell)

Description:
This module exploits CVE-2025-61882 in Oracle E-Business Suite
          by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection.

          The exploit hosts a malicious XSL file
          that the target will fetch and process, leading to RCE.

          This module provides an interactive shell session.
          Vulnerable versions affected are 12.2.3-12.2.14.

Check method (fingerprinting):
vprint_status('Checking if target is vulnerable...')

    return CheckCode::Safe('Oracle E-Business Suite not detected') unless oracle_ebs_detected?

    csrf_token = retrieve_csrf_token
    return CheckCode::Unknown('Failed to retrieve CSRF token') unless csrf_token

    return CheckCode::Appears('The target appears to be vulnerable') if vulnerable_servlet_accessible?(csrf_token)

    CheckCode::Safe('Vulnerable servlet is not accessible')
  end

  # Serve malicious XSLT file
Metasploit Module: Sun/Oracle GlassFish Server Authenticated Code Execution
Type: exploit
Path: modules/exploits/multi/http/glassfish_deployer.rb
Platform: java
Disclosure date: 2011-08-04
References: CVE-2011-0807, OSVDB-71948
Targets: Java Universal, Windows Universal, Linux Universal

Description:
This module logs in to a GlassFish Server (Open Source or Commercial) using various
          methods (such as authentication bypass, default credentials, or user-supplied login),
          and deploys a malicious war file in order to get remote code execution. It has been
          tested on Glassfish 2.x, 3.0, 4.0 and Sun Java System Application Server 9.x. Newer
          GlassFish versions do not allow remote access (Secure Admin) by default, but is required
          for exploitation.
Metasploit Module: Authenticated RCE in Splunk (SimpleXML dashboard PDF generation)
Type: exploit
Path: modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb
Platform: python
Disclosure date: 2022-11-02
References: CVE-2022-43571, URL-https://advisory.splunk.com/advisories/SVD-2022-1111, URL-https://web.archive.org/web/[PII_REDACTED]3608/https://psytester.github.io/CVE-2022-43571_SPLUNK_RCE/

Description:
This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise.

          An attacker can inject arbitrary Python code into style parameters, such as the fillColor or lineColor of a sparkline element within a Splunk SimpleXML dashboard.
          The malicious code is executed when a user triggers the PDF export function for the dashboard.

          The affected versions include any release prior to 8.1.12, as well as versions 8.2.0 through 8.2.9 and 9.0.0 through 9.0.2.

Check method (fingerprinting):
@cookie = splunk_login(datastore['USERNAME'], datastore['PASSWORD'])
    version = splunk_home_version(@cookie)
    if version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.11')) ||
       version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.8')) ||
       version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.0.1'))
      return CheckCode::Appears("Exploitable version found: #{version}")
    end

    return CheckCode::Safe("Non-vulnerable version found: #{version}") if !version.nil?

    return CheckCode::Unknown('Target does not appear to be a Splunk instance')
  end
Metasploit Module: Pentaho Business Server Auth Bypass and Server Side Template Injection RCE
Type: exploit
Path: modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb
Platform: unix
Disclosure date: 2023-04-04
References: URL-https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py, URL-https://research.aurainfosec.io/pentest/pentah0wnage/, URL-https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]301, CVE-2022-43769, CVE-2022-43939
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is
          vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability
          (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user
          running the Pentaho Business Analytics Server.

          The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any
          URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string
          "js" followed optionally by "?" and then any characters of the attacker's choice.

          The second (CVE-2022-43769) is a server side
          template injection. This vulnerability allows RCE by making a GET request to /api/ldap/config/ldapTreeNodeChildren and
          setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within
          Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.

Check method (fingerprinting):
# This check method abuses the authentication bypass vulnerability CVE-2022-43939 to check exploitability. Due to a
    # bad regex in applicationContext-spring-security.xml endpoints that should not be accessible without authentication
    # are made accessible if the URL ends in "/", followed by "require", optionally "-js" or "-cfg", any character,
    # and then the string "js" followed optionally by "?" and then any characters of the attacker's choice.

    post_require_mixup = ['-cfg', '-js', ''].sample
    period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js")
    )

    return Exploit::CheckCode::Unknown('Could not authenticate to the target') unless res

    if res.code == 200 && res.body == '{}'
      Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Metasploit Web UI Static secret_key_base Value
Type: exploit
Path: modules/exploits/multi/http/metasploit_static_secret_key_base.rb
Platform: ruby
Disclosure date: 2016-09-15
References: URL-https://www.rapid7.com/blog/post/2016/09/15/important-security-fixes-in-metasploit-4[PII_REDACTED]401, URL-https://github.com/justinsteven/advisories/blob/master/2016_metasploit_rce_static_key_deserialization.md

Description:
This module exploits the Web UI for Metasploit Community, Express and
          Pro where one of a certain set of Weekly Releases have been applied.
          These Weekly Releases introduced a static secret_key_base value.
          Knowledge of the static secret_key_base value allows for
          deserialization of a crafted Ruby Object, achieving code execution.

          This module is based on
          exploits/multi/http/rails_secret_deserialization

Check method (fingerprinting):
cookie_name = '_ui_session'

    vprint_status("Checking for cookie #{cookie_name}")
    res = send_request_cgi({
      'uri' => datastore['TARGETURI'] || "/",
      'method' => 'GET',
    }, 25)

    unless res
      return Exploit::CheckCode::Unknown('No response received from the target')   # Target didn't respond
    end

    if res.get_cookies.empty?
      return Exploit::CheckCode::Unknown('No cookies received from the target')   # Target didn't send us any cookies. We can't continue.
    end

    match = res.get_cookies.match(/([_A-Za-z0-9]+)=([A-Za-z0-9%]*)--([0-9A-Fa-f]+);/)

    unless match
      return Exploit::CheckCode::Unknown('No session cookie found in the response')   # Target didn't send us a session cookie. We can't continue.
    end

    if match[1] == cookie_name
      vprint_status("Found cookie")
    else
      vprint_status("Adjusting cookie name to #{match[1]}")
      cookie_name = match[1]
    end

    vprint_status("Searching for proper secret")

    (version, secret) = get_secret(match[2], match[3])

    if secret
      vprint_status("Found secret, detected version #{version}")
      Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    else
      Exploit::CheckCode::Safe('The target version is not vulnerable')
    end
  end

  #
  # Send the actual request
  #
Metasploit Module: phpMyAdmin Authenticated Remote Code Execution via preg_replace()
Type: exploit
Path: modules/exploits/multi/http/phpmyadmin_preg_replace.rb
Platform: php
Disclosure date: 2013-04-25
References: CVE-2013-3238, EDB-25003, OSVDB-92793, URL-http://www.waraxe.us/advisory-103.html, URL-http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php

Description:
This module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin's
          replace_prefix_tbl within libraries/mult_submits.inc.php via db_settings.php
          This affects versions 3.5.x < 3.5.8.1 and 4.0.0 < 4.0.0-rc3.
          PHP versions > 5.4.6 are not vulnerable.

Check method (fingerprinting):
begin
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/js/messages.php') })
    rescue
      vprint_error("Unable to connect to server.")
      return CheckCode::Unknown('Failed to connect to the target.')
    end

    return CheckCode::Unknown('No response received from the target') unless res

    if res.code != 200
      vprint_error("Unable to query /js/messages.php")
      return CheckCode::Unknown('Unable to query /js/messages.php to determine version.')
    end

    php_version = res['X-Powered-By']
    if php_version
      vprint_status("PHP Version: #{php_version}")
      if php_version =~ /PHP\/(\d)\.(\d)\.(\d)/
        if $1.to_i > 5
          return CheckCode::Safe("PHP version #{php_version} is not vulnerable. The preg_replace /e modifier was deprecated in PHP 5.5 and removed in PHP 7.0.")
        else
          if $1.to_i == 5 and $2.to_i > 4
            return CheckCode::Safe("PHP version #{php_version} is not vulnerable. The preg_replace /e modifier was deprecated in PHP 5.5 and removed in PHP 7.0.")
          else
            if $1.to_i == 5 and $2.to_i == 4 and $3.to_i > 6
              return CheckCode::Safe("PHP version #{php_version} is not vulnerable. The preg_replace /e modifier was deprecated in PHP 5.5 and removed in PHP 7.0.")
            end
          end
        end
      end
    else
      vprint_status("Unknown PHP Version")
    end

    if res.body =~ /pmaversion = '(.*)';/
      print_status("phpMyAdmin version: #{$1}")
Metasploit Module: STUNSHELL Web Shell Remote PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/stunshell_eval.rb
Platform: php
Disclosure date: 2013-03-23
References: OSVDB-91842, URL-https://defense.ballastsecurity.net/wiki/index.php/STUNSHELL, URL-https://defense.ballastsecurity.net/decoding/index.php?hash=a4cd8ba05eb6ba7fb86dd66bed968007

Description:
This module exploits unauthenticated versions of the "STUNSHELL" web shell.
          This module works when safe mode is enabled on the web server. This shell is widely
          used in automated RFI payloads.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path.to_s)
    request_parameters = {
      'method'	=> 'POST',
      'uri'	=> uri,
      'vars_post'	=>
        {
          'cmd' => "php_eval",
          'php_eval' => "print 'andalas_oku test parameter';"
        }
    }
    shell = send_request_cgi(request_parameters)
    if (shell and shell.body =~ /andalas_oku test parameter/)
      return Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: GitList v0.6.0 Argument Injection Vulnerability
Type: exploit
Path: modules/exploits/multi/http/gitlist_arg_injection.rb
Platform: php
Disclosure date: 2018-04-26
References: CVE-2[PII_REDACTED], EDB-44548, URL-http://web.archive.org/web/[PII_REDACTED]4133/https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html

Description:
This module exploits an argument injection vulnerability in GitList v0.6.0.
          The vulnerability arises from GitList improperly validating input using the php function
          'escapeshellarg'.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => uri
    )

    if res && res.code == 200 && /Powered by .*GitList 0\.6\.0/.match(res.body)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Apache NiFi API Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/apache_nifi_processor_rce.rb
Platform: unix
Disclosure date: 2020-10-03
Authors: Graeme Robinson
References: URL-https://nifi.apache.org/, URL-https://github.com/apache/nifi, URL-https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-standard-nar/1.12.1/
Targets: Unix (In-Memory), Windows (In-Memory)

Description:
This module uses the NiFi API to create an ExecuteProcess processor that will execute OS commands. The API must
          be unsecured (or credentials provided) and the ExecuteProcess processor must be available. An ExecuteProcessor
          processor is created then is configured with the payload and started. The processor is then stopped and
          deleted.

          Verified against 1.12.1, 1.12.1-RC2, and 1.20.0

Check method (fingerprinting):
# As far as I can tell from the API documentation, it's not possible to check whether the required permissions are
    # present unless "permission to check permissions" is granted. For this reason it reports:
    # * "Unknown" if a timeout is experienced when checking whether login is required
    # * "Safe" if the response to the login check is not one of the two expected responses because it's probably not
    #      NiFi
    # * "Detected" if login is required, because it has confirmed that NiFi is running on the port becuase it got an
    #      expected response
    # * "Appears" if login is not required because it has confirmed that Nifi is running because it got the expected
    #      response and if there is no authentication then there is no way of restricting the ExecuteCode permimssion

    @cleanup_required = false

    login_type = supports_login?

    return CheckCode::Unknown('Unable to determine if logins are supported') if login_type.nil?

    if login_type
      return CheckCode::Appears('Apache NiFi instance supports logins')
    end

    CheckCode::Detected('Apache NiFi instance does not support logins')
  end
Metasploit Module: Atlassian Confluence SSTI Injection
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb
Platform: unix
Disclosure date: 2024-01-16
References: CVE-2023-22527, URL-https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server[PII_REDACTED].html, URL-https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
Targets: Unix Command, Windows Command

Description:
This module exploits an SSTI injection in Atlassian Confluence servers. A specially crafted HTTP request uses
          the injection to evaluate an OGNL expression resulting in OS command execution.
          Versions 8.5.0 through 8.5.3 and 8.0 to 8.4 are known to be vulnerable.

Check method (fingerprinting):
confluence_version = get_confluence_version
    return CheckCode::Unknown('Failed to determine the Confluence version.') unless confluence_version

    vprint_status("Detected Confluence version: #{confluence_version}")
    if confluence_version > Rex::Version.new('8.5.3')
      return CheckCode::Safe("Version #{confluence_version} is not affected.")
    end

    confluence_platform = get_confluence_platform
    unless confluence_platform
      return CheckCode::Safe('Failed to test OGNL injection.')
    end

    vprint_status("Detected target platform: #{confluence_platform}")
    CheckCode::Vulnerable('Successfully tested OGNL injection.')
  end
Metasploit Module: Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE
Type: exploit
Path: modules/exploits/multi/http/subrion_cms_file_upload_rce.rb
Platform: php
Disclosure date: 2018-11-04
References: EDB-49876, CVE-2018-19422, URL-https://github.com/intelliants/subrion/issues/801, URL-https://github.com/intelliants/subrion/issues/840
Targets: PHP

Description:
This module exploits an authenticated file upload vulnerability in
          Subrion CMS versions 4.2.1 and lower. The vulnerability is caused by
          the .htaccess file not preventing the execution of .pht, .phar, and
          .xhtml files. Files with these extensions are not included in the
          .htaccess blacklist, hence these files can be uploaded and executed
          to achieve remote code execution. In this module, a .phar file with
          a randomized name is uploaded and executed to receive a Meterpreter
          session on the target, then deletes itself afterwards.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'panel/') # requires a trailing forward slash
    print_status("Checking target web server for a response at: #{full_uri(uri)}")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri
    })

    unless res
      return CheckCode::Unknown('Target did not respond to check request.')
    end

    unless res.code == 200 && res.body.downcase.include?('subrion')
      return CheckCode::Unknown('Target is not running Subrion CMS.')
    end

    print_good('Target is running Subrion CMS.')

    # Powered by <a href="https://subrion.org/" title="Subrion CMS">Subrion CMS v4.2.1</a><br>
    print_status('Checking Subrion CMS version...')
    version_number = res.body.to_s.scan(/Subrion\sCMS\sv([\d.]+)/).flatten.first

    unless version_number
      return CheckCode::Detected('Subrion CMS version cannot be determined.')
    end

    print_good("Target is running Subrion CMS Version #{version_number}.")

    if Rex::Version.new(version_number) <= Rex::Version.new('4.2.1')
      return CheckCode::Appears(
        'However, this version check does not guarantee that the target is vulnerable, ' \
        'since a fix for the vulnerability can easily be applied by a web admin.'
      )
    end

    return CheckCode::Safe('The target is not running a vulnerable version')
  end