deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Micro Focus Operations Bridge Manager Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/microfocus_obm_auth_rce.rb
Platform: java
Disclosure date: 2020-10-28
References: URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md, CVE-2020-11853, ZDI-20-1327

Description:
This module exploits an authenticated Java deserialization that affects a truckload of Micro
          Focus products: Operations Bridge Manager, Application Performance Management, Data Center Automation,
          Universal CMDB, Hybrid Cloud Management and Service Management Automation. However this module
          was only tested on Operations Bridge Manager.
          Exploiting this vulnerability will result in remote code execution as the root user on Linux or
          the SYSTEM user on Windows.
          Authentication is required, the module user needs to login to the application and obtain the
          authenticated LWSSO_COOKIE_KEY, which should be fed to the module. Any authenticated user can
          exploit this vulnerability, even the lowest privileged ones.
          For more information refer to the advisory link below.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/topaz/login.jsp')
    })

    # unfortunately could not find an easy way to detect the version running, even when auth
    if res && res.code == 200 && res.body.include?('Login - Operations Bridge Manager')
      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    return Exploit::CheckCode::Unknown('Operations Bridge Manager not detected')
  end
Metasploit Module: Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/kordil_edms_upload_exec.rb
Platform: php
Disclosure date: 2013-02-22
References: CVE-2013-10066, OSVDB-90645, EDB-24547

Description:
This module exploits a vulnerability in Kordil EDMS v2.2.60rc3.
          This application has an upload feature that allows an unauthenticated user
          to upload arbitrary files to the '/kordil_edms/userpictures/' directory.

Check method (fingerprinting):
base = target_uri.path
    peer = "#{rhost}:#{rport}"

    # retrieve software version from login page
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(base, 'global_group_login.php')
      })
      if res and res.code == 200
        if res.body =~ /<center><font face="Arial" size="2">Kordil EDMS v2\.2\.60/
          return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
        elsif res.body =~ /Kordil EDMS v/
          return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
        end
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/ibm_openadmin_tool_soap_welcomeserver_exec.rb
Platform: php
Disclosure date: 2017-05-30
References: CVE-2017-1092, EDB-42091, URL-https://www-01.ibm.com/support/docview.wss?uid=swg22002897, URL-https://blogs.securiteam.com/index.php/archives/3210, URL-https://seclists.org/fulldisclosure/2017/May/105

Description:
This module exploits an unauthenticated remote PHP code execution
          vulnerability in IBM OpenAdmin Tool included with IBM Informix
          versions 11.5, 11.7, and 12.1.

          The 'welcomeServer' SOAP service does not properly validate user input
          in the 'new_home_page' parameter of the 'saveHomePage' method allowing
          arbitrary PHP code to be written to the config.php file. The config.php
          file is executed in most pages within the application, and accessible
          directly via the web root, resulting in code execution.

          This module has been tested successfully on IBM OpenAdmin Tool 3.14
          on Informix 12.10 Developer Edition (SUSE Linux 11) virtual appliance.

Check method (fingerprinting):
fingerprint = Rex::Text.rand_text_alpha(rand(10) + 6)
    res = set_home_page "\";##{fingerprint}"

    unless res
      vprint_status "#{peer} Connection failed"
      return CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200 && res.body =~ %r{<ns1:saveHomePageResponse><return xsi:type="xsd:string">";##{fingerprint}</return>}
      return CheckCode::Detected('The target service was detected')
    end

    Msf::Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Tatsu Wordpress Plugin RCE
Type: exploit
Path: modules/exploits/multi/http/wp_tatsu_rce.rb
Platform: php
Disclosure date: 2022-04-25
References: CVE-2021-25094, EDB-52260
Targets: PHP

Description:
This module adds exploit for CVE-2021-25094 - unauthenticated remote code execution in Tatsu Wordpress plugin <= 3.3.11. Module uploads malicious zip with PHP payload that gets executed in second part of exploit.

Check method (fingerprinting):
return CheckCode::Unknown('Target not responding') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("Detected WordPress version: #{wp_version}") if wp_version

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/wp-content/plugins/tatsu/changelog.md')
    })

    return CheckCode::Unknown('Could not find tatsu plugin') unless res&.code == 200

    changelog_body = res.body

    return CheckCode::Safe('Could not find tatsu plugin') if changelog_body.blank?

    return CheckCode::Detected('Tatsu plugin detected but it failed to get version') unless changelog_body.match(/v(\d\d?.\d\d?.\d\d?)/)

    version = Rex::Version.new(Regexp.last_match(1))

    return CheckCode::Appears("Found version #{version}") if version <= Rex::Version.new('3.3.11')

    return CheckCode::Safe('Patched version detected')
  end
Metasploit Module: Nostromo Directory Traversal Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/nostromo_code_exec.rb
Platform: linux
Disclosure date: 2019-10-20
References: CVE-2019-16278, URL-https://www.sudokaikan.com/2019/10/cve-2019-16278-unauthenticated-remote.html
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits a remote command execution vulnerability in
          Nostromo <= 1.9.6. This issue is caused by a directory traversal
          in the function `http_verify` in nostromo nhttpd allowing an attacker
          to achieve remote code execution via a crafted HTTP request.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      vprint_error('Connection failed')
      return CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200 and res.headers['Server'] =~ /nostromo [\d.]{5}/
      /nostromo (?<version>[\d.]{5})/ =~ res.headers['Server']
      if Rex::Version.new(version) <= Rex::Version.new('1.9.6')
        return CheckCode::Appears('The target is running a vulnerable version')
      end
    end

    return CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Apache Struts 2 Namespace Redirect OGNL Injection
Type: exploit
Path: modules/exploits/multi/http/struts2_namespace_ognl.rb
Platform: %w{unix windows linux}
Disclosure date: 2018-08-22
References: CVE-2018-11776, URL-https://lgtm.com/blog/apache_struts_CVE-2018-11776, URL-https://cwiki.apache.org/confluence/display/WW/S2-057, URL-https://github.com/hook-s3c/CVE-2018-11776-Python-PoC

Description:
This module exploits a remote code execution vulnerability in Apache Struts
          version 2.3 - 2.3.4, and 2.5 - 2.5.16. Remote Code Execution can be performed
          via an endpoint that makes use of a redirect action.

          Note that this exploit is dependant on the version of Tomcat running on
          the target.  Versions of Tomcat starting with 7.0.88 currently don't
          support payloads larger than ~7.5kb.  Windows Meterpreter sessions on
          Tomcat >=7.0.88 are currently not supported.

          Native payloads will be converted to executables and dropped in the
          server's temp dir. If this fails, try a cmd/* payload, which won't
          have to write to the disk.

Check method (fingerprinting):
# METHOD 1: Try to extract the state of hte allowStaticMethodAccess variable
    ognl = "#_memberAccess['allowStaticMethodAccess']"

    resp = send_struts_request(ognl)

    # If vulnerable, the server should return an HTTP 302 (Redirect)
    #   and the 'Location' header should contain either 'true' or 'false'
    if resp && resp.headers['Location']
      output = resp.headers['Location']
      vprint_status("Redirected to:  #{output}")
      if (output.include? '/true/')
        print_status("Target does *not* require enabling 'allowStaticMethodAccess'.  Setting ENABLE_STATIC to 'false'")
        datastore['ENABLE_STATIC'] = false
        CheckCode::Vulnerable('Successfully executed the injected code')
      elsif (output.include? '/false/')
        print_status("Target requires enabling 'allowStaticMethodAccess'.  Setting ENABLE_STATIC to 'true'")
        datastore['ENABLE_STATIC'] = true
        CheckCode::Vulnerable('Successfully executed the injected code')
      else
        CheckCode::Safe('The target is not vulnerable')
      end
    elsif resp && resp.code == 400
      # METHOD 2: Generate two random numbers, ask the target to add them together.
      #   If it does, it's vulnerable.
      a = rand(10000)
      b = rand(10000)
      c = a + b

      ognl = "#{a}+#{b}"

      resp = send_struts_request(ognl)

      if resp.headers['Location'].include? c.to_s
        vprint_status("Redirected to:  #{resp.headers['Location']}")
        print_status("Target does *not*
Metasploit Module: HorizontCMS Arbitrary PHP File Upload
Type: exploit
Path: modules/exploits/multi/http/horizontcms_upload_exec.rb
Platform: php
Disclosure date: 2020-09-24
References: CVE-2020-27387
Targets: PHP, Linux, Windows

Description:
This module exploits an arbitrary file upload vulnerability in
          HorizontCMS 1.0.0-beta in order to execute arbitrary commands.

          The module first attempts to authenticate to HorizontCMS. It then tries
          to upload a malicious PHP file via an HTTP POST request to
          `/admin/file-manager/fileupload`. The server will rename this file to a
          random string. The module will therefore attempt to change the filename
          back to the original name via an HTTP POST request to
          `/admin/file-manager/rename`. For the `php` target, the payload is
          embedded in the uploaded file and the module attempts to execute the
          payload via an HTTP GET request to `/storage/file_name`. For the `linux`
          and `windows` targets, the module uploads a simple PHP web shell
          similar to `<?php system($_GET["cmd"]); ?>`. Subsequently, it leverages
          the CmdStager mixin to deliver the final payload via a series of HTTP
          GET requests to the PHP web shell.

          Valid credentials for a HorizontCMS user with permissions to use the
          FileManager are required. This would be all users in the Admin, Manager
          and Editor groups if HorizontCMS is configured with the default group
          settings.This module has been successfully tested against HorizontCMS
          1.0.0-beta running on Ubuntu 18.04.

Check method (fingerprinting):
vprint_status('Running check')

    # visit /admin/login to obtain HorizontCMS version plus cookies and csrf token
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin', 'login'),
      'keep_cookies' => true
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200 && res.body.include?('HorizontCMS')
      return CheckCode::Safe('Target is not a HorizontCMS application.')
    end

    # obtain csrf token
    html = res.get_html_document
    @csrf_token = html.at('meta[@name="csrf-token"]')['content']

    # obtain version
    /Version: (?<version>.*?)\n/ =~ res.body

    unless version
      return CheckCode::Detected('Could not determine HorizontCMS version.')
    end

    # vulnerable versions all start with 1.0.0 followed by `-beta`, `-alpha` or `-alpha.<number>`
    version_no, version_status = version.split('-')

    unless version_no == '1.0.0' && version_status && (version_status.include?('alpha') || version_status.include?('beta'))
      return CheckCode::Safe("Target is HorizontCMS with version #{version}")
    end

    CheckCode::Appears("Target is HorizontCMS with version #{version}")
  end
Metasploit Module: Langflow AI RCE
Type: exploit
Path: modules/exploits/multi/http/langflow_unauth_rce_cve_2025_3248.rb
Platform: python
Disclosure date: 2025-04-09
References: CVE-2025-3248, URL-https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/
Targets: Python payload

Description:
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.
          A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/version')
    })
    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless res&.code == 200

    json_version = res&.get_json_document&.fetch('version', nil)
    return Exploit::CheckCode::Unknown('Failed to parse version.') unless json_version

    version = Rex::Version.new(json_version)
    return Exploit::CheckCode::Unknown('Failed to get version.') unless version

    return Exploit::CheckCode::Appears("Version #{version} detected. Which is vulnerable even if authentication is enabled.") if version < Rex::Version.new('1.3.0')

    # check if auto_login is enabled or not
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/auto_login')
    })
    return Exploit::CheckCode::Appears("Version #{version} detected and authentication is disabled. Which is vulnerable.") if res&.code == 200

    Exploit::CheckCode.Safe("Version #{version} detected and authentication is enabled. which is not vulnerable.")
  end
Metasploit Module: Moodle SpellChecker Path Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/moodle_spelling_path_rce.rb
Platform: php
Disclosure date: 2021-06-22
References: CVE-2021-21809, URL-http://web.archive.org/web/[PII_REDACTED]3941/https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277

Description:
Moodle allows an authenticated administrator to define spellcheck settings via the web interface.
          An administrator can update the aspell path to include a command injection. This is extremely
          similar to CVE-2013-3630, just using a different variable.

          This module was tested against Moodle version 3.11.2, 3.10.0, and 3.8.0.

Check method (fingerprinting):
return CheckCode::Unknown('No web server or moodle instance found') unless moodle_and_online?

    v = moodle_version
    return CheckCode::Detected('Unable to determine moodle version') if v.nil?
    # according to talso advisory, 2021-04-21 - Vendor updated documentation to suggest best practices after installation
    # so maybe this is not going to get patched?  Assuming 3.0.0+
    if Rex::Version.new(v) > Rex::Version.new('3.0.0')
      return CheckCode::Appears("Exploitable Moodle version #{v} detected")
    end

    CheckCode::Safe("Non-exploitable Moodle version #{v} detected")
  end
Metasploit Module: Unauthenticated RCE in Bricks Builder Theme
Type: exploit
Path: modules/exploits/multi/http/wp_bricks_builder_rce.rb
Platform: php
Disclosure date: 2024-02-19
References: CVE-2024-25600, URL-https://github.com/Chocapikk/CVE-2024-25600, URL-https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
This module exploits an unauthenticated remote code execution vulnerability in the
          Bricks Builder Theme versions <= 1.9.6 for WordPress. The vulnerability allows attackers
          to execute arbitrary PHP code by leveraging a nonce leakage to bypass authentication and
          exploit the eval() function usage within the theme. Successful exploitation allows for full
          control of the affected WordPress site. It is recommended to upgrade to version 1.9.6.1 or higher.

Check method (fingerprinting):
return CheckCode::Unknown('WordPress does not appear to be online.') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("WordPress Version: #{wp_version}") if wp_version

    theme_check_code = check_theme_version_from_style('bricks', '1.9.6.1')
    return CheckCode::Unknown('The Bricks Builder theme does not appear to be installed') unless theme_check_code
    return CheckCode::Detected('The Bricks Builder theme is running but the version was unable to be determined') if theme_check_code.code == 'detected'
    return CheckCode::Safe("The Bricks Builder is running version: #{theme_check_code.details[:version]}, which is not vulnerable.") unless theme_check_code.code == 'appears'

    theme_version = theme_check_code.details[:version]
    print_good("Detected Bricks Builder theme version: #{theme_version}")
    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: GiveWP Unauthenticated Donation Process Exploit
Type: exploit
Path: modules/exploits/multi/http/wp_givewp_rce.rb
Platform: %w[unix linux
Disclosure date: 2024-08-25
References: CVE-2024-5932, URL-https://github.com/EQSTLab/CVE-2024-5932, URL-https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932, URL-https://www.wordfence.com/blog/2024/08/4998-bounty-awarded-and-100000-wordpress-sites-protected-against-unauthenticated-remote-code-execution-vulnerability-patched-in-givewp-wordpress-plugin, CVE-2024-8353, URL-https://github.com/EQSTLab/CVE-2024-8353, URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/give/givewp-donation-plugin-and-fundraising-platform-3161-unauthenticated-php-object-injection
Targets: Unix/Linux Command Shell, Windows Command Shell

Description:
The GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions up to and including 3.16.1,
          is vulnerable to a PHP Object Injection (POI) attack that allows unauthenticated arbitrary code execution.
          Although a patch was introduced in version 3.14.2, it was incorrect and can be bypassed.
          This means the vulnerability remains exploitable in subsequent versions due to the ineffective patch.

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    print_status("WordPress Version: #{wordpress_version}") if wordpress_version

    detected_version = check_plugin_version_from_readme('give')&.details&.dig(:version)

    if detected_version.nil?
      print_warning('Unable to determine the GiveWP plugin version.')
      return CheckCode::Unknown('No response received from the target')
    end

    detected_version = Rex::Version.new(detected_version)
    print_good("Detected GiveWP Plugin version: #{detected_version}")

    if detected_version < Rex::Version.new('3.14.2')
      print_good('Vulnerable to both CVE-2024-5932 and CVE-2024-8353 (bypass).')
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    if detected_version < Rex::Version.new('3.16.2')
      print_good('Vulnerable to CVE-2024-8353 (bypass).')
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    print_status("GiveWP Plugin version #{detected_version} is not vulnerable.")
    CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Oracle WebLogic Server Administration Console Handle RCE
Type: exploit
Path: modules/exploits/multi/http/weblogic_admin_handle_rce.rb
Platform: unix
Disclosure date: 2020-10-20
References: CVE-2020-14882, CVE-2020-14883, CVE-2020-14750, EDB-48971, URL-https://www.oracle.com/security-alerts/cpuoct2020.html, URL-https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a path traversal and a Java class instantiation
          in the handle implementation of WebLogic's Administration Console to
          execute code as the WebLogic user.

          Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and
          14.1.1.0.0 are known to be affected.

          Tested against 12.2.1.3.0 from Vulhub (Linux) and on Windows.

          Warning! Multiple sessions may be created by exploiting this vuln.

Check method (fingerprinting):
res = send_request_handle(rand_text_alphanumeric(8..42))

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    if res.code == 200 && res.body.include?('Deploying Application')
      raise RuntimeError
    end

    # HTTP/1.1 302 Moved Temporarily
    # [snip]
    # Location: http://127.0.0.1:7001/console/console.portal?_nfpb=true&_pageLabel=UnexpectedExceptionPage
    # [snip]
    unless res.code == 302 &&
           res.redirection.path == '/console/console.portal' &&
           res.redirection.query.include?('_pageLabel=UnexpectedExceptionPage')
      return CheckCode::Safe('Path traversal failed.')
    end

    CheckCode::Vulnerable('Path traversal successful.')
  rescue RuntimeError
    vprint_error('Application is deploying, sleeping and retrying check')

    sleep(1)
    retry
  end
Metasploit Module: CMS Made Simple Authenticated RCE via File Upload/Copy
Type: exploit
Path: modules/exploits/multi/http/cmsms_upload_rename_rce.rb
Disclosure date: 2018-07-03
References: CVE-2[PII_REDACTED], EDB-44976, URL-http://dev.cmsmadesimple.org/bug/view/11741

Description:
CMS Made Simple allows an authenticated administrator to upload a file
          and rename it to have a .php extension. The file can then be executed
          by opening the URL of the file in the /uploads/ directory.

          This module has been successfully tested on CMS Made Simple versions
          2.2.5 and 2.2.7.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not connect to the target')
    end

    unless res.body =~ /CMS Made Simple/i
      return CheckCode::Safe('The target is not vulnerable')
    end

    if res.body =~ %r{CMS Made Simple</a> version (\d+\.\d+\.\d+)}i
      version = Rex::Version.new($1)
      vprint_status("#{peer} - CMS Made Simple Version: #{version}")

      if version == Rex::Version.new('2.2.5')
        return CheckCode::Appears('The target is running a vulnerable version')
      end
    end

    CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  end