deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Fortinet FortiWeb create new local admin
Type: auxiliary
Path: modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb
Disclosure date: 2025-11-14
References: CVE-2025-64446, URL-https://x.com/defusedcyber/status/[PII_REDACTED]73517373, URL-https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass, URL-https://www.pwndefend.com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/, URL-https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/, URL-https://www.fortiguard.com/psirt/FG-IR-25-910

Description:
This auxiliary module exploits an authentication bypass via path traversal vulnerability in the Fortinet
          FortiWeb management interface to create a new local administrator user account. This vulnerability affects the
          following versions:

          * FortiWeb 8.0.0 through 8.0.1 (Patched in 8.0.2 and above)
          * FortiWeb 7.6.0 through 7.6.4 (Patched in 7.6.5 and above)
          * FortiWeb 7.4.0 through 7.4.9 (Patched in 7.4.10 and above)
          * FortiWeb 7.2.0 through 7.2.11 (Patched in 7.2.12 and above)
          * FortiWeb 7.0.0 through 7.0.11 (Patched in 7.0.12 and above)

Check method (fingerprinting):
res = post_auth_bypass_request({ data: {} })

    return Exploit::CheckCode::Unknown('Connection failed') unless res

    return Exploit::CheckCode::Safe('Received a 403 Forbidden response') if res.code == 403

    j = JSON.parse(res.body)

    # Tested against vulnerable FortiWeb versions 8.0.1, 7.4.8, 6.4.3, and 6.3.9
    return Exploit::CheckCode::Appears('Authentication bypass succeeded on FortiWeb') if j.dig('results', 'errcode') == -56

    Exploit::CheckCode::Unknown('Unexpected JSON results')
  rescue JSON::ParserError
    return Exploit::CheckCode::Unknown('Failed to parse JSON body')
  end
Metasploit Module: Netgear Unauthenticated SOAP Password Extractor
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_soap_password_extractor.rb
Disclosure date: Feb 11 2015
References: BID-72640, OSVDB-118316, URL-https://github.com/darkarnium/secpub/tree/master/Vulnerabilities/NetGear/SOAPWNDR

Description:
This module exploits an authentication bypass vulnerability in different Netgear devices.
        It allows to extract the password for the remote management interface. This module has been
        tested on a Netgear WNDR3700v4 - V1.0.1.42, but other devices are reported as vulnerable:
        NetGear WNDR3700v4 - V1.0.0.4SH, NetGear WNDR3700v4 - V1.0.1.52, NetGear WNR2200 - V1.0.1.88,
        NetGear WNR2500 - V1.0.0.24, NetGear WNDR3700v2 - V1.0.1.14 (Tested by Paula Thomas),
        NetGear WNDR3700v1 - V1.0.16.98 (Tested by Michal Bartoszkiewicz),
        NetGear WNDR3700v1 - V1.0.7.98 (Tested by Michal Bartoszkiewicz),
        NetGear WNDR4300 - V1.0.1.60 (Tested by Ronny Lindner),
        NetGear R6300v2 - V1.0.3.8 (Tested by Robert Mueller),
        NetGear WNDR3300 - V1.0.45 (Tested by Robert Mueller),
        NetGear WNDR3800 - V1.0.0.48 (Tested by an Anonymous contributor),
        NetGear WNR1000v2 - V1.0.1.1 (Tested by Jimi Sebree),
        NetGear WNR1000v2 - V1.1.2.58 (Tested by Chris Boulton),
        NetGear WNR2000v3 - v1.1.2.10 (Tested by h00die)
Metasploit Module: Joomla Account Creation and Privilege Escalation
Type: auxiliary
Path: modules/auxiliary/admin/http/joomla_registration_privesc.rb
Disclosure date: 2016-10-25
References: CVE-2016-8869, CVE-2016-8870, URL-https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-elevated-privileges.html, URL-https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-account-creation.html, URL-https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2

Description:
This module creates an arbitrary account with administrative privileges in Joomla versions 3.4.4
          through 3.6.3. If an email server is configured in Joomla, an email will be sent to activate the account (the account is disabled by default).

Check method (fingerprinting):
res = send_request_cgi('uri' => target_uri.path)

    unless res
      vprint_error('Unable to connect to target')
      return Exploit::CheckCode::Unknown('Unable to connect to target')
    end

    unless joomla_and_online?
      vprint_error('Unable to detect Joomla')
      return Exploit::CheckCode::Safe('Target does not appear to be Joomla')
    end

    version = Rex::Version.new(joomla_version)

    unless version
      vprint_error('Unable to detect Joomla version')
      return Exploit::CheckCode::Detected('Joomla detected but version could not be determined')
    end

    vprint_status("Detected Joomla version #{version}")

    if version.between?(Rex::Version.new('3.4.4'), Rex::Version.new('3.6.3'))
      return Exploit::CheckCode::Appears("Joomla #{version} is in the vulnerable range 3.4.4-3.6.3")
    end

    Exploit::CheckCode::Safe("Joomla #{version} is not in the vulnerable range")
  end
Metasploit Module: Arris / Motorola Surfboard SBG6580 Web Interface Takeover
Type: auxiliary
Path: modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb
Disclosure date: 2015-04-08
References: CVE-2015-0964, CVE-2015-0965, CVE-2015-0966, URL-http://web.archive.org/web/[PII_REDACTED]3803/https://www.rapid7.com/blog/post/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems/

Description:
The web interface for the Arris / Motorola Surfboard SBG6580 has
          several vulnerabilities that, when combined, allow an arbitrary website to take
          control of the modem, even if the user is not currently logged in. The attacker
          must successfully know, or guess, the target's internal gateway IP address.
          This is usually a default value of 192.168.0.1.

          First, a hardcoded backdoor account was discovered in the source code
          of one device with the credentials "technician/yZgO8Bvj". Due to lack of CSRF
          in the device's login form, these credentials - along with the default
          "admin/motorola" - can be sent to the device by an arbitrary website, thus
          inadvertently logging the user into the router.

          Once successfully logged in, a persistent XSS vulnerability is
          exploited in the firewall configuration page. This allows injection of
          Javascript that can perform any available action in the router interface.

          The following firmware versions have been tested as vulnerable:

          SBG6580-6.5.2.0-GA-06-077-NOSH, and
          SBG6580-8.6.1.0-GA-04-098-NOSH
Metasploit Module: Netgear R7000 backup.cgi Heap Overflow RCE
Type: auxiliary
Path: modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb
Platform: linux
Disclosure date: 2021-04-21
References: URL-https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/, CVE-2021-31802

Description:
This module exploits a heap buffer overflow in the genie.cgi?backup.cgi
          page of Netgear R7000 routers running firmware version 1.0.11.116.
          Successful exploitation results in unauthenticated attackers gaining
          code execution as the root user.

          The exploit utilizes these privileges to enable the telnet server
          which allows attackers to connect to the target and execute commands
          as the admin user from within a BusyBox shell. Users can connect to
          this telnet server by running the command "telnet *target IP*".

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/' })
    if res.nil?
      return Exploit::CheckCode::Unknown('Connection timed out.')
    end

    # Checks for the `WWW-Authenticate` header in the response
    if res.headers['WWW-Authenticate']
      data = res.to_s
      marker_one = 'Basic realm="NETGEAR '
      marker_two = '"'
      model = scrape(data, marker_one, marker_two)
      print_status("Router is a NETGEAR router (#{model})")
      if model == 'R7000' && check_vuln_firmware
        return Exploit::CheckCode::Vulnerable('NETGEAR R7000 with vulnerable firmware')
      end

    else
      print_error('Router is not a NETGEAR router')
    end
    return Exploit::CheckCode::Safe('Target does not appear to be a vulnerable NETGEAR router')
  end
Metasploit Module: Iomega StorCenter Pro NAS Web Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb
References: OSVDB-55586, CVE-2009-2367

Description:
The Iomega StorCenter Pro Network Attached Storage device web interface increments sessions IDs,
        allowing for simple brute force attacks to bypass authentication and gain administrative
        access.
Metasploit Module: Supra Smart Cloud TV Remote File Inclusion
Type: auxiliary
Path: modules/auxiliary/admin/http/supra_smart_cloud_tv_rfi.rb
Disclosure date: 2019-06-03
References: CVE-2019-12477, URL-https://www.inputzero.io/2019/06/hacking-smart-tv.html

Description:
This module exploits an unauthenticated remote file inclusion which
          exists in Supra Smart Cloud TV. The media control for the device doesn't
          have any session management or authentication. Leveraging this, an
          attacker on the local network can send a crafted request to broadcast a
          fake video.
Metasploit Module: WhatsUp Gold SQL Injection (CVE-2024-6670)
Type: auxiliary
Path: modules/auxiliary/admin/http/whatsup_gold_sqli.rb
Disclosure date: 2024-08-29
References: CVE-2024-6670, URL-https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024, URL-https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/, URL-https://www.zerodayinitiative.com/advisories/ZDI-24-1185/

Description:
This module exploits a SQL injection vulnerability in WhatsUp Gold, by changing the password of an existing user (such as of the default admin account)
          to an attacker-controlled one.

          WhatsUp Gold versions < v24.0.0 are affected.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'NmConsole/app.json')
    })

    return Exploit::CheckCode::Unknown('No response or unexpected HTTP status') unless res && res.code == 200

    data = res.get_json_document
    data_js = data['js']
    version_path = data_js.find { |item| item['path'] =~ /app-/ }['path']
    version = version_path[/app-(.*)\.js/, 1]
    if version.nil?
      return Exploit::CheckCode::Unknown('Could not determine WhatsUp Gold version')
    else
      vprint_status('Version retrieved: ' + version)
    end

    return Exploit::CheckCode::Appears("Version: #{version}") if Rex::Version.new(version) <= Rex::Version.new('23.1.3')

    Exploit::CheckCode::Safe("WhatsUp Gold version #{version} is not vulnerable")
  end
Metasploit Module: Intersil (Boa) HTTPd Basic Authentication Password Reset
Type: auxiliary
Path: modules/auxiliary/admin/http/intersil_pass_reset.rb
Disclosure date: 2007-09-10
References: CVE-2007-4915, BID-25676

Description:
The Intersil extension in the Boa HTTP Server 0.93.x - 0.94.11
          allows basic authentication bypass when the user string is greater
          than 127 bytes long.  The long string causes the password to be
          overwritten in memory, which enables the attacker to reset the
          password.  In addition, the malicious attempt also may cause a
          denial-of-service condition.

          Please note that you must set the request URI to the directory that
          requires basic authentication in order to work properly.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    if res && (m = res.headers['Server'].match(%r{Boa/(.*)}))
      vprint_status("Boa Version Detected: #{m[1]}")
      return Exploit::CheckCode::Safe("Boa version #{m[1]} is not vulnerable") if (m[1][0].ord - 48 > 0) # boa server wrong version
      return Exploit::CheckCode::Safe("Boa version #{m[1]} is not vulnerable") if (m[1][3].ord - 48 > 4)

      return Exploit::CheckCode::Vulnerable("Boa version #{m[1]} is vulnerable")
    end

    return Exploit::CheckCode::Safe('Not a Boa Server!')
  rescue Rex::ConnectionRefused
    print_error('Connection refused by server.')
    return Exploit::CheckCode::Safe('Connection refused by server')
  end
Metasploit Module: Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment
Type: auxiliary
Path: modules/auxiliary/admin/http/foreman_openstack_satellite_priv_esc.rb
Disclosure date: Jun 6 2013
Authors: Ramon de C Valle
References: BID-60835, CVE-2013-2113, OSVDB-94655, URL-https://bugzilla.redhat.com/show_bug.cgi?id=966804, URL-https://projects.theforeman.org/issues/2630

Description:
This module exploits a mass assignment vulnerability in the 'create'
        action of 'users' controller of Foreman and Red Hat OpenStack/Satellite
        (Foreman 1.2.0-RC1 and earlier) by creating an arbitrary administrator
        account. For this exploit to work, your account must have 'create_users'
        permission (e.g., Manager role).
Metasploit Module: Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)
Type: auxiliary
Path: modules/auxiliary/admin/http/ivanti_vtm_admin.rb
Disclosure date: 2024-08-05
References: CVE-2024-7593, URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593?language=en_US

Description:
This module exploits an access control issue in Ivanti Virtual Traffic Manager (vTM), by adding a new
          administrative user to the web interface of the application.

          Affected versions include 22.7R1, 22.6R1, 22.5R1, 22.3R2, 22.3, 22.2.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri, 'apps', 'zxtm', 'login.cgi')
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?

    body = res.body
    version_regex = /StingrayVersion\.Set\(\s*'([^']+)'\s*,/
    match = body.match(version_regex)
    if match
      version = match[1]
      return Exploit::CheckCode::Appears("Version: #{version}") if Rex::Version.new(version) <= Rex::Version.new('22.7R1')
    else
      return Exploit::CheckCode::Safe('Could not detect Ivanti vTM version')
    end

    Exploit::CheckCode::Safe('Ivanti vTM version is not vulnerable')
  end
Metasploit Module: Ruby on Rails Devise Authentication Password Reset
Type: auxiliary
Path: modules/auxiliary/admin/http/rails_devise_pass_reset.rb
Disclosure date: 2013-01-28
References: CVE-2013-0233, OSVDB-89642, BID-57577, URL-http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/, URL-http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html, URL-https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8, URL-https://github.com/rails/rails/commit/26e13c3ca71cbc7859cc4c51e64f[PII_REDACTED]d8

Description:
The Devise authentication gem for Ruby on Rails is vulnerable
          to a password reset exploit leveraging type confusion.  By submitting XML
          to rails, we can influence the type used for the reset_password_token
          parameter.  This allows for resetting passwords of arbitrary accounts,
          knowing only the associated email address.

          This module defaults to the most common devise URIs and response values,
          but these may require adjustment for implementations which customize them.

          Affects Devise < v2.2.3, 2.1.3, 2.0.5 and 1.5.4 when backed by any database
          except PostgreSQL or SQLite3. Tested with v2.2.2, 2.1.2, and 2.0.4 on Rails
          3.2.11. Patch applied to Rails 3.2.12 and 3.1.11 should prevent exploitation
          of this vulnerability, by quoting numeric values when comparing them with
          non numeric values.
Metasploit Module: GitLab Password Reset Account Takeover
Type: auxiliary
Path: modules/auxiliary/admin/http/gitlab_password_reset_account_takeover.rb
Disclosure date: 2024-01-11
References: CVE-2023-7028, URL-https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/, URL-https://github.com/duy-31/CVE-2023-7028

Description:
This module exploits an account-take-over vulnerability that allows users
        to take control of a gitlab account without user interaction.

        The vulnerability lies in the password reset functionality. Its possible to provide 2 emails
        and the reset code will be sent to both. It is therefore possible to provide the e-mail
        address of the target account as well as that of one we control, and to reset the password.

        2-factor authentication prevents this vulnerability from being exploitable. There is no
        discernable difference between a vulnerable and non-vulnerable server response.

        Vulnerable versions include:
        16.1 < 16.1.6,
        16.2 < 16.2.9,
        16.3 < 16.3.7,
        16.4 < 16.4.5,
        16.5 < 16.5.6,
        16.6 < 16.6.4,
        and 16.7 < 16.7.2.
Metasploit Module: ScadaBR Credentials Dumper
Type: auxiliary
Path: modules/auxiliary/admin/http/scadabr_credential_dump.rb
Disclosure date: 2017-05-28
Authors: bcoles
References: URL-http://www.scadabr.com.br/?q=node/1375

Description:
This module retrieves credentials from ScadaBR, including
          service credentials and unsalted SHA1 password hashes for
          all users, by invoking the `EmportDwr.createExportData` DWR
          method of Mango M2M which is exposed to all authenticated
          users regardless of privilege level.

          This module has been tested successfully with ScadaBR
          versions 1.0 CE and 0.9 on Windows and Ubuntu systems.
Metasploit Module: Typo3 sa-2009-002 File Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/http/typo3_sa_2009_002.rb
Disclosure date: 2009-02-10
References: OSVDB-52048, CVE-2009-0815, URL-http://web.archive.org/web/[PII_REDACTED]5636/http://secunia.com:80/advisories/33829/, EDB-8038, URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/

Description:
This module exploits a file disclosure vulnerability in the jumpUrl mechanism of
          Typo3. This flaw can be used to read any file that the web server user account has
          access to.
Metasploit Module: TYPO3 sa-2010-020 Remote File Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/http/typo3_sa_2010_020.rb
References: CVE-2010-3714, URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020, URL-http://web.archive.org/web/[PII_REDACTED]3019/http://gregorkopf.de/slides_berlinsides_2010.pdf

Description:
This module exploits a flaw in the way the TYPO3 jumpurl feature matches hashes.
        Due to this flaw a Remote File Disclosure is possible by matching the juhash of 0.
        This flaw can be used to read any file that the web server user account has access to view.
Metasploit Module: WordPress Symposium Plugin SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_symposium_sql_injection.rb
Disclosure date: 2015-08-18
References: CVE-2015-6522, EDB-37824

Description:
This module exploits a SQL injection vulnerability in the WP Symposium plugin
          before 15.8 for WordPress, which allows remote attackers to extract credentials
          via the size parameter to get_album_item.php.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-symposium', '15.8.0', '15.5.1')
  end
Metasploit Module: ManageEngine NetFlow Analyzer Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/netflow_file_download.rb
Disclosure date: 2014-11-30
References: CVE-2014-5445, OSVDB-115340, URL-https://seclists.org/fulldisclosure/2014/Dec/9, URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_netflow_it360_file_dl.txt

Description:
This module exploits an arbitrary file download vulnerability in CSVServlet
          on ManageEngine NetFlow Analyzer. This module has been tested on both Windows
          and Linux with versions 8.6 to 10.2. Note that when typing Windows paths, you
          must escape the backslash with a backslash.
Metasploit Module: WordPress Google Maps Plugin SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_google_maps_sqli.rb
Disclosure date: 2019-04-02
References: CVE-2019-10692

Description:
This module exploits a SQL injection vulnerability in a REST endpoint
        registered by the WordPress plugin wp-google-maps between 7.11.00 and
        7.11.17 (included).

        As the table prefix can be changed by administrators, set DB_PREFIX
        accordingly.

Check method (fingerprinting):
mynum = Rex::Text.rand_text_numeric(8..20).to_s
    body = send_sql_request(mynum)
    return Exploit::CheckCode::Unknown('No response from target') if body.nil?
    return Exploit::CheckCode::Vulnerable('SQL injection returned expected test value') if body.include?(mynum)

    Exploit::CheckCode::Unknown('SQL injection test did not return expected result')
  end
Metasploit Module: Telpho10 Backup Credentials Dumper
Type: auxiliary
Path: modules/auxiliary/admin/http/telpho10_credential_dump.rb
Platform: linux
Disclosure date: 2016-09-02
Authors: Jan Rude
References: URL-https://github.com/whoot/TelpOWN

Description:
This module exploits a vulnerability present in all versions of Telpho10 telephone system
          appliance. This module generates a configuration backup of Telpho10,
          downloads the file and dumps the credentials for admin login,
          phpmyadmin, phpldapadmin, etc.
          This module has been successfully tested on the appliance versions 2.6.31 and 2.6.39.
Metasploit Module: WordPress custom-contact-forms Plugin SQL Upload
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_custom_contact_forms.rb
Disclosure date: 2014-08-07
References: URL-http://blog.sucuri.net/2014/08/database-takeover-in-custom-contact-forms.html, URL-https://plugins.trac.wordpress.org/changeset?old_path=%2Fcustom-contact-forms%2Ftags%2F5.1.0.3&old=997569&new_path=%2Fcustom-contact-forms%2Ftags%2F5.1.0.4&new=997569&sfp_email=&sfph_mail=

Description:
The WordPress custom-contact-forms plugin <= 5.1.0.3 allows unauthenticated users to download
          a SQL dump of the plugins database tables. It's also possible to upload files containing
          SQL statements which will be executed. The module first tries to extract the WordPress
          table prefix from the dump and then attempts to create a new admin user.