deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WebDAV PHP Upload
Type: exploit
Path: modules/exploits/multi/http/webdav_upload_php.rb
Platform: php
Disclosure date: 2012-01-14
References: CVE-2012-10062

Description:
This module exploits WebDAV which also has PHP enabled,
          such as found on XAMPP servers.
          It can use do by using any supplied credentials to upload via WebDAV,
          a PHP payload and then execute it.

Check method (fingerprinting):
test_file = rand_text_alphanumeric(rand(8..15)) + '.php'
    test_url = normalize_uri(datastore['URI'], test_file)
    payload = rand_text_alphanumeric(rand(8..15))
    res_creds = build_res_creds

    # Check
    vprint_status "Checking for WebDAV: #{datastore['URI']}"
    res = send_request_raw({
      'uri' => normalize_uri(datastore['URI']),
      'method' => 'OPTIONS'
    }.merge(res_creds), 10)
    return Exploit::CheckCode::Unknown('No response received from the target') unless res

    unless res.code == 200
      print_error "Target responded: HTTP #{res.code}, should be 200"
      print_res_code(res, res_creds)
      return Exploit::CheckCode::Unknown("Target responded with unexpected HTTP status #{res.code}")
    end

    # Record results!
    opts, service = report_webdav_service(res, res_creds)

    # First see if it already exists (it really shouldn't)
    vprint_status "Checking for test file: #{test_url}"
    res = send_request_raw({
      'uri' => test_url
    }.merge(res_creds), 10)
    return Exploit::CheckCode::Unknown('No response received from the target') unless res
    return Exploit::CheckCode::Unknown("The test file may already exists (HTTP #{res.code})") unless res.code == 404 # Need to try again with a different file

    # Try to create it
    vprint_status "Attempting to upload: #{test_url}"
    res = send_request_cgi({
      'uri' => test_url,
      'method' => 'PUT',
      'data' => payload
    }.merge(res_creds), 10)
    return Exploit::CheckC
Metasploit Module: Apache Solr Remote Code Execution via Velocity Template
Type: exploit
Path: modules/exploits/multi/http/solr_velocity_rce.rb
Platform: java
Disclosure date: 2019-10-29
References: EDB-47572, CVE-2019-17558, URL-https://www.tenable.com/blog/apache-solr-vulnerable-to-remote-code-execution-zero-day-vulnerability, URL-https://www.huaweicloud.com/en-us/notice/2018/[PII_REDACTED]0849387.html, URL-https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133/, URL-https://github.com/jas502n/solr_rce, URL-https://github.com/AleWong/Apache-Solr-RCE-via-Velocity-template
Targets: Java (in-memory), Unix (in-memory), Linux (dropper), x86/x64 Windows PowerShell, x86/x64 Windows CmdStager, Windows Exec

Description:
This module exploits a vulnerability in Apache Solr <= 8.3.0 which allows remote code execution via a custom
          Velocity template. Currently, this module only supports Solr basic authentication.

          From the Tenable advisory:
          An attacker could target a vulnerable Apache Solr instance by first identifying a list
          of Solr core names. Once the core names have been identified, an attacker can send a specially crafted
          HTTP POST request to the Config API to toggle the params resource loader value for the Velocity Response
          Writer in the solrconfig.xml file to true. Enabling this parameter would allow an attacker to use the Velocity
          template parameter in a specially crafted Solr request, leading to RCE.

Check method (fingerprinting):
auth_res = check_auth
    unless auth_res
      return CheckCode::Unknown('Authentication failed!')
    end

    # convert to JSON
    ver_json = auth_res.get_json_document
    # get Solr version
    solr_version = Rex::Version.new(ver_json['lucene']['solr-spec-version'])
    print_status("Found Apache Solr #{solr_version}")
    # get OS version details
    @target_platform = ver_json['system']['name']
    target_arch = ver_json['system']['arch']
    target_osver = ver_json['system']['version']
    print_status("OS version is #{@target_platform} #{target_arch} #{target_osver}")
    # uname doesn't show up for Windows, so run a check for that
    if ver_json['system']['uname']
      # print uname only when verbose
      vprint_status("Full uname is '#{ver_json['system']['uname'].strip}'")
    end

    # the vulnerability is only present in Solr versions <= 8.3.0
    unless solr_version <= Rex::Version.new('8.3.0')
      return CheckCode::Safe('Running version of Solr is not vulnerable!')
    end

    # enumerate cores
    cores = solr_get(
      'uri' => normalize_uri(target_uri.path, '/admin/cores'),
      'vars_get' => { 'wt' => 'json' },
      'auth' => @auth_string
    )

    # can't connect? that's yet another automatic failure
    unless cores
      return CheckCode::Unknown('Could not enumerate cores!')
    end

    # convert to JSON yet again
    cores_json = cores.get_json_document
    # draw up an array of all the cores
    cores_list = Array.new
    # get the core n
Metasploit Module: Wordpress LiteSpeed Cache plugin cookie theft
Type: exploit
Path: modules/exploits/multi/http/wp_litespeed_cookie_theft.rb
Platform: php
Disclosure date: 2024-09-04
References: URL-https://patchstack.com/articles/critical-account-takeover-vulnerability-patched-in-litespeed-cache-plugin/, CVE-2024-44000
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin
          that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when
          the Debug Logging feature is enabled, the plugin will log admin cookies to the /wp-content/debug.log endpoint
          which is accessible without authentication. The Debug Logging feature in the plugin is not enabled by default.
          The admin cookies found in the debug.log can be used to upload and execute a malicious plugin containing a payload.

Check method (fingerprinting):
@admin_cookie = get_valid_admin_cookie
    CheckCode::Vulnerable('Found and tested valid admin cookie, we can upload and execute a payload')
  rescue WordPressNotOnline => e
    return CheckCode::Unknown("This doesn't appear to be a WordPress site: #{e.class}, #{e}")
  rescue DebugLogError => e
    return CheckCode::Safe("#{e.class}, #{e}")
  rescue AdminCookieError => e
    return CheckCode::Safe("#{e.class}, #{e}")
  end
Metasploit Module: Remote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893)
Type: exploit
Path: modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb
Platform: unix
Disclosure date: 2025-02-20
References: CVE-2025-24893
Targets: Unix Command, Windows Command

Description:
This module exploits a template injection vulnerability in the the XWiki Platform.
          XWiki includes a macro called SolrSearch (defined in Main.SolrSearchMacros) that enables full-text search through the embedded Solr engine.
          The vulnerability stems from the way this macro evaluates search parameters in Groovy, failing to sanitize or restrict malicious input.

          This vulnerability affects XWiki Platform versions >= 5.3-milestone-2 and < 15.10.11, and versions >= 16.0.0-rc-1 and < 16.4.1.
          Successful exploitation may result in the remote code execution under the privileges
          of the web server, potentially exposing sensitive data or disrupting survey operations.

          An attacker can execute arbitrary system commands in the context of the user running the web server.

Check method (fingerprinting):
print_status('Extracting version...')

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/xwiki/bin/view/Main/'),
      'method' => 'GET'
    )
    return CheckCode::Unknown('No response from target') unless res&.code == 200

    version_div = res.get_html_document.at('div[id="xwikiplatformversion"]')
    return CheckCode::Safe('Possibly not XWiki or incorrect path (version tag not found)') unless version_div

    version_match = version_div.text.match(/XWiki.*?(\d+\.\d+\.\d+)/)
    unless version_match
      print_error("#{peer} - Unable to extract version number")
      return CheckCode::Detected('XWiki detected, but version number missing or unrecognized')
    end

    version = Rex::Version.new(Regexp.last_match(1).to_s)
    print_status("Extracted version: #{version}")

    if version.between?(Rex::Version.new('5.3.0'), Rex::Version.new('15.10.10')) ||
       version.between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.4.0'))
      return CheckCode::Appears("Detected version #{version}, which is vulnerable")
    end

    return CheckCode::Safe("Version #{version} appears safe")
  end
Metasploit Module: SPIP Unauthenticated RCE via porte_plume Plugin
Type: exploit
Path: modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb
Platform: php
Disclosure date: 2024-08-16
References: CVE-2024-7954, URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html, URL-https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a Remote Code Execution vulnerability in SPIP versions up to and including 4.2.12.
          The vulnerability occurs in SPIP's templating system where it incorrectly handles user-supplied input,
          allowing an attacker to inject and execute arbitrary PHP code. This can be achieved by crafting a
          payload manipulating the templating data processed by the `echappe_retour()` function, invoking
          `traitements_previsu_php_modeles_eval()`, which contains an `eval()` call.

Check method (fingerprinting):
rversion = spip_version || spip_plugin_version('spip')
    return Exploit::CheckCode::Unknown('Unable to determine the version of SPIP') unless rversion

    print_status("SPIP Version detected: #{rversion}")

    vulnerable_ranges = [
      { start: Rex::Version.new('4.2.0'), end: Rex::Version.new('4.2.12') },
      { start: Rex::Version.new('4.1.0'), end: Rex::Version.new('4.1.15') },
      { start: Rex::Version.new('0.0.0'), end: Rex::Version.new('4.0.99') }
    ]

    is_vulnerable = vulnerable_ranges.any? { |range| rversion.between?(range[:start], range[:end]) }

    unless is_vulnerable
      return CheckCode::Safe("The detected SPIP version (#{rversion}) is not vulnerable.")
    end

    print_good("SPIP version #{rversion} is vulnerable.")
    plugin_version = spip_plugin_version('porte_plume')

    unless plugin_version
      print_warning('Could not determine the version of the porte_plume plugin.')
      return CheckCode::Appears("The detected SPIP version (#{rversion}) is vulnerable.")
    end

    print_status("Porte plume plugin version detected: #{plugin_version}")
    if plugin_version < Rex::Version.new('3.1.6')
      return CheckCode::Appears("Both the detected SPIP version (#{rversion}) and porte_plume version (#{plugin_version}) are vulnerable.")
    end

    CheckCode::Appears("The detected SPIP version (#{rversion}) is vulnerable.")
  end
Metasploit Module: Ruby on Rails ActionPack Inline ERB Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_actionpack_inline_exec.rb
Platform: ruby
Disclosure date: 2016-03-01
References: CVE-2016-2098

Description:
This module exploits a remote code execution vulnerability in the
          inline request processor of the Ruby on Rails ActionPack component.
          This vulnerability allows an attacker to process ERB to the inline
          JSON processor, which is then rendered, permitting full RCE within
          the runtime, without logging an error condition.
Metasploit Module: Adobe ColdFusion Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb
Platform: java
Disclosure date: 2023-03-14
References: CVE-2023-26360, URL-https://attackerkb.com/topics/F36ClHTTIQ/cve-2023-26360/rapid7-analysis
Targets: Generic Java, Windows Command, Windows Dropper, Unix Command, Linux Dropper

Description:
This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe
          ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in
          order to gain remote code execution.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    return CheckCode::Unknown('Connection failed') unless res

    # If ColdFusion is deployed with the Development profile (rather than Production) we will get a directory listing
    # returned for the first request. We can detect that here and send a second request to a CFC endpoint that we
    # know will return a ColdFusion cookie.
    if res.code == 200 && res.body.include?('<title>Directory Listing For [/]</title>')
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => '/CFIDE/componentutils/cfcexplorer.cfc'
      )

      return CheckCode::Unknown('Connection failed') unless res
    end

    # We cannot identify the ColdFusion version through a generic technique. Instead we use the Recog fingerprint
    # to match a ColdFusion cookie, and use this information to detect ColdFusion as being present.
    # https://github.com/rapid7/recog/blob/main/xml/http_cookies.xml#L69

    if res.get_cookies =~ /(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=|.cfusion/
      return CheckCode::Detected('ColdFusion detected but version number is unknown.')
    end

    CheckCode::Unknown('Could not connect to the target')
  end
Metasploit Module: Wordpress Plugin Elementor Authenticated Upload Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_elementor_auth_upload_rce.rb
Disclosure date: 2022-03-29
References: EDB-50115, CVE-2022-1329, URL-https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/, URL-https://www.youtube.com/watch?v=tIhN1svzAYk

Description:
The WordPress plugin Elementor versions 3.6.0 - 3.6.2, inclusive have a vulnerability
          that allows any authenticated user to upload and execute any PHP file. This is achieved
          by sending a request to install Elementor Pro from a user supplied zip file.
          Any user with Subscriber or more permissions is able to execute this.
          Tested against Elementor 3.6.1

Check method (fingerprinting):
unless wordpress_and_online?
      return CheckCode::Safe('Server not online or not detected as Wordpress')
    end

    cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])
    CheckCode::Safe('Invalid credentials given!') unless cookie

    return check_plugin_version_from_readme('elementor', '3.6.3', '3.6.0')
  end
Metasploit Module: PHP-FPM Underflow RCE
Type: exploit
Path: modules/exploits/multi/http/php_fpm_rce.rb
Platform: php
Disclosure date: 2019-10-22
References: CVE-2019-11043, EDB-47553, URL-https://github.com/neex/phuip-fpizdam, URL-https://bugs.php.net/bug.php?id=78599, URL-https://blog.orange.tw/2019/10/an-analysis-and-thought-about-recently.html
Targets: PHP, Shell Command

Description:
This module exploits an underflow vulnerability in versions 7.1.x
          below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 of PHP-FPM on
          Nginx. Only servers with certains Nginx + PHP-FPM configurations are
          exploitable. This is a port of the original neex's exploit code (see
          refs.). First, it detects the correct parameters (Query String Length
          and custom header length) needed to trigger code execution. This step
          determines if the target is actually vulnerable (Check method). Then,
          the exploit sets a series of PHP INI directives to create a file
          locally on the target, which enables code execution through a query
          string parameter. This is used to execute normal payload stagers.
          Finally, this module does some cleanup by killing local PHP-FPM
          workers (those are spawned automatically once killed) and removing
          the created local file.

Check method (fingerprinting):
print_status('Sending baseline query...')
    res = send_crafted_request(path: "/path\ninfo.php")
    return CheckCode::Unknown('Error when sending baseline query') unless res

    @base_status = res.code
    vprint_status("Base status code is #{@base_status}")

    if datastore['QSLHint']
      print_status("Skipping qsl detection, using hint (qsl=#{datastore['QSLHint']})")
      qsl_candidates = [datastore['QSLHint']]
    else
      print_status('Detecting QSL...')
      qsl_candidates = detect_qsl
    end
    if qsl_candidates.empty?
      return CheckCode::Detected('No qsl candidates found, not vulnerable or something went wrong')
    end
    if qsl_candidates.size > datastore['MaxQSLCandidates']
      return CheckCode::Detected('Too many qsl candidates found, looks like I got banned')
    end

    print_good("The target is probably vulnerable. Possible QSLs: #{qsl_candidates}")

    qsl_candidates = extend_qsl_list(qsl_candidates)
    vprint_status("Extended QSL list: #{qsl_candidates}")

    print_status('Doing sanity check...')
    return CheckCode::Detected('Sanity check failed') unless sanity_check?

    print_status('Detecting attack parameters...')
    @params = detect_params(qsl_candidates)
    return CheckCode::Detected('Unable to detect parameters') unless @params

    print_good("Parameters found: QSL=#{@params[:qsl]}, customh_length=#{@params[:customh_length]}")
    print_good('Target is vulnerable!')
    CheckCode::Vulnerable('The target is vulnerable')
  ens
Metasploit Module: JBoss JMX Console Deployer Upload and Execute
Type: exploit
Path: modules/exploits/multi/http/jboss_maindeployer.rb
Platform: java
Disclosure date: 2007-02-20
References: CVE-2007-1036, CVE-2010-0738, OSVDB-33744, URL-http://www.redteam-pentesting.de/publications/jboss, URL-https://bugzilla.redhat.com/show_bug.cgi?id=574105
Targets: Automatic (Java based), Windows Universal, Linux Universal, Java Universal

Description:
This module can be used to execute a payload on JBoss servers that have
          an exposed "jmx-console" application. The payload is put on the server by
          using the jboss.system:MainDeployer functionality. To accomplish this, a
          temporary HTTP server is created to serve a WAR archive containing our
          payload. This method will only work if the target server allows outbound
          connections to us.
Metasploit Module: Atlassian Confluence Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb
Platform: java
Disclosure date: 2023-10-04
References: CVE-2023-22515, URL-https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis, URL-https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
Targets: Automatic

Description:
This module exploits an improper input validation issue in Atlassian Confluence, allowing arbitrary HTTP
          parameters to be translated into getter/setter sequences via the XWorks2 middleware and in turn allows for
          Java objects to be modified at run time. The exploit will create a new administrator user and upload a
          malicious plugins to get arbitrary code execution. All versions of Confluence between 8.0.0 through to 8.3.2,
          8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1 are affected.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, datastore['CONFLUENCE_TARGET_ENDPOINT'])
    )

    return CheckCode::Unknown('Connection failed') unless res

    # Ensure target is a Confluence server by identifying an expected HTTP header.
    return CheckCode::Unknown('No \'X-Confluence-Request-Time\' header') unless res.headers.key? 'X-Confluence-Request-Time'

    if res.code == 200 && res.body
      # Pull out the version string from one of three known locations within the HTML.
      m = res.body.match(/ajs-version-number" content="(\d+\.\d+\.\d+)"/i)
      if m.nil?
        m = res.body.match(/Printed by Atlassian Confluence (\d+\.\d+\.\d+)/i)
        if m.nil?
          m = res.body.match(%r{<span id='footer-build-information'>(\d+\.\d+\.\d+)</span>}i)
        end
      end

      unless m.nil?
        version = Rex::Version.new(m[1])

        ranges = [
          ['8.0.0', '8.3.2'],
          ['8.4.0', '8.4.2'],
          ['8.5.0', '8.5.1']
        ]

        # If we have a Confluence server within the given version ranges, it appears vulnerable.
        ranges.each do |min, max|
          if version.between?(Rex::Version.new(min), Rex::Version.new(max))
            return Exploit::CheckCode::Appears("Atlassian Confluence #{version}")
          end
        end

        # By here we know we have a confluence server, but the version found indicates it is safe.
        return Exploit::CheckCode::Safe("Atlassian Confluence
Metasploit Module: ClipBucket beats_uploader Unauthenticated Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/clipbucket_fileupload_exec.rb
Platform: php
Disclosure date: 2018-03-03
References: CVE-2018-7665, EDB-44250

Description:
This module exploits a vulnerability found in ClipBucket versions before 4.0.0 (Release 4902).
          A malicious file can be uploaded using an unauthenticated arbitrary file upload vulnerability.
          It is possible for an attacker to upload a malicious script to issue operating system commands.
          This issue is caused by improper session handling in /action/beats_uploader.php file.
          This module was tested on ClipBucket before 4.0.0 - Release 4902 on Windows 7 and Kali Linux.

Check method (fingerprinting):
vprint_status('Trying to detect ClipBucket on target.')

    # check for readme file
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'readme')
    })

    unless res
      vprint_error('Connection failed')
      return CheckCode::Unknown('Could not connect to the target')
    end

    unless res.code == 200 && res.body.include?('ClipBucket')
      vprint_error('Could not find readme')
      return CheckCode::Safe('The target is not vulnerable')
    end

    # check for beats_uploader.php file
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'actions', 'beats_uploader.php')
    })

    unless res
      vprint_error('Connection failed')
      return CheckCode::Unknown('Could not connect to the target')
    end

    unless res.code == 200
      vprint_error('Could not find beats_uploader.php')
      return CheckCode::Safe('The target is not vulnerable')
    end

    Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end