deardaniel/secdata-raw huggingface dataset:
Metasploit Module: eXtplorer v2.1 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/extplorer_upload_exec.rb
Platform: php
Disclosure date: 2012-12-31
References: CVE-2012-6710, OSVDB-88751, BID-57058, URL-http://web.archive.org/web/[PII_REDACTED]3508/https://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability/, URL-http://extplorer.net/issues/105

Description:
This module exploits an authentication bypass vulnerability in eXtplorer
          versions 2.1.0 to 2.1.2 and 2.1.0RC5 when run as a standalone application.
          This application has an upload feature that allows an authenticated user
          with administrator roles to upload arbitrary files to any writable
          directory in the web root. This module uses an authentication bypass
          vulnerability to upload and execute a file.

Check method (fingerprinting):
base = target_uri.path
    base << '/' if base[-1, 1] != '/'
    peer = "#{rhost}:#{rport}"

    # retrieve software version from ./extplorer.xml
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => "#{base}extplorer.xml"
      })

      if !res or res.code != 200
        return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
      end

      if res.body =~ /<version>2\.1\.(0RC\d|0|1|2)<\/version>/
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      end

      if res.body =~ /eXtplorer/
        return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Drupal HTTP Parameter Key/Value SQL Injection
Type: exploit
Path: modules/exploits/multi/http/drupal_drupageddon.rb
Platform: php
Disclosure date: 2014-10-15
References: CVE-2014-3704, URL-https://www.drupal.org/SA-CORE-2014-005, URL-http://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html, URL-https://www.whitewinterwolf.com/posts/2017/11/16/drupageddon-revisited-a-new-path-from-sql-injection-to-remote-command-execution-cve-2014-3704/

Description:
This module exploits the Drupal HTTP Parameter Key/Value SQL Injection
          (aka Drupageddon) in order to achieve a remote shell on the vulnerable
          instance. This module was tested against Drupal 7.0 and 7.31 (was fixed
          in 7.32).

          Two methods are available to trigger the PHP payload on the target:

          - set TARGET 0:
          Form-cache PHP injection method (default).
          This uses the SQLi to upload a malicious form to Drupal's cache,
          then trigger the cache entry to execute the payload using a POP chain.

          - set TARGET 1:
          User-post injection method.
          This creates a new Drupal user, adds it to the administrators group,
          enable Drupal's PHP module, grant the administrators the right to
          bundle PHP code in their post, create a new post containing the
          payload and preview it to trigger the payload execution.
Metasploit Module: UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)
Type: exploit
Path: modules/exploits/multi/http/ubiquiti_unifi_log4shell.rb
Platform: win
Disclosure date: 2021-12-09
References: CVE-2021-44228, URL-https://www.sprocketsecurity.com/blog/another-log4j-on-the-fire-unifi, URL-https://github.com/puzzlepeaches/Log4jUnifi, URL-https://community.ui.com/releases/UniFi-Network-Application-6-5-54/d717f241-48bb-4979-8b10-99db36ddabe1
Targets: Unix

Description:
The Ubiquiti UniFi Network Application versions 5.13.29 through 6.5.53 are affected by the Log4Shell
        vulnerability whereby a JNDI string can be sent to the server via the 'remember' field of a POST request to the
        /api/login endpoint that will cause the server to connect to the attacker and deserialize a malicious Java
        object. This results in OS command execution in the context of the server application.

        This module will start an LDAP server that the target will need to connect to.

Check method (fingerprinting):
validate_configuration!
    res = send_request_cgi('uri' => normalize_uri(target_uri, 'status'))
    return Exploit::CheckCode::Unknown('No HTTP response was received.') if res.nil?

    server_version = res.get_json_document.dig('meta', 'server_version')
    return Exploit::CheckCode::Safe('The target service does not appear to be running.') unless server_version =~ /(\d+\.)+/

    vprint_status("Detected version: #{server_version}")
    server_version = Rex::Version.new(server_version)
    if server_version < Rex::Version.new('5.13.29')
      return Exploit::CheckCode::Safe('Versions prior to 5.13.29 are not exploitable.')
    elsif server_version > Rex::Version.new('6.5.53')
      return Exploit::CheckCode::Safe('Versions after 6.5.53 are patched and not affected.')
    end

    vprint_status('The target appears to be a vulnerable version, attempting to trigger the vulnerability...')

    start_service
    res = trigger
    return Exploit::CheckCode::Unknown('No HTTP response was received.') if res.nil?

    wait_until { @search_received }
    @search_received ? Exploit::CheckCode::Vulnerable('The target is running a vulnerable version') : Exploit::CheckCode::Unknown('No LDAP search query was received.')
  ensure
    cleanup_service
  end
Metasploit Module: Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
Type: exploit
Path: modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb
Platform: unix
Disclosure date: 2025-12-01
References: CVE-2025-66294, URL-https://github.com/advisories/GHSA-662m-56v4-3r8f, CVE-2025-66301, URL-https://github.com/advisories/GHSA-v8x2-fjv7-8hjh
Targets: Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a Server-Side Template Injection (SSTI)
          vulnerability (CVE-2025-66294) in Grav CMS that allows bypassing the
          Twig sandbox to achieve remote code execution. The cleanDangerousTwig
          method uses weak regex that fails to sanitize nested Twig calls within
          the evaluate_twig function. To inject the payload, this module leverages
          CVE-2025-66301, a broken access control flaw that allows users with page
          editing privileges to modify the form's YAML frontmatter process section.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin'),
      'keep_cookies' => true
    )
    return CheckCode::Unknown('Connection failed') unless res

    html = res.get_html_document
    return CheckCode::Unknown('Could not parse HTML') unless html

    # First, verify this is a Grav installation
    return CheckCode::Safe('Target does not appear to be a Grav installation') unless grav_installation?(html)

    # Then verify we have access to the login form
    return CheckCode::Detected('Grav detected but login form not accessible') unless login_form_present?(html)

    version_str = get_version_after_login
    unless version_str
      return CheckCode::Detected('Grav CMS detected but version could not be determined')
    end

    version = Rex::Version.new(version_str.gsub('-', '.'))

    if version < Rex::Version.new('1.8.0.beta.27')
      return CheckCode::Appears("Grav CMS #{version_str} is vulnerable")
    end

    CheckCode::Safe("Grav CMS #{version_str} is patched")
  rescue ArgumentError
    CheckCode::Detected("Grav CMS detected, version parsing failed: #{version_str}")
  rescue ::Rex::ConnectionError
    CheckCode::Unknown('Connection failed')
  end
Metasploit Module: Apache Struts Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
Platform: win
Disclosure date: 2012-01-06
References: CVE-2012-0391, OSVDB-78277, EDB-18329
Targets: Windows Universal, Linux Universal, Java Universal

Description:
This module exploits a remote command execution vulnerability in
          Apache Struts versions < 2.2.1.1. This issue is caused because the
          ExceptionDelegator interprets parameter values as OGNL expressions
          during certain exception handling for mismatched data types of properties,
          which allows remote attackers to execute arbitrary Java code via a
          crafted parameter.
Metasploit Module: vBulletin replaceAdTemplate Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb
Platform: %w[unix linux
Disclosure date: 2025-05-23
References: URL-https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce, CVE-2025-48827, CVE-2025-48828
Targets: Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a design flaw in vBulletin's AJAX API handler and template rendering system,
          present in versions 5.0.0 through 6.0.3. The vulnerability allows unauthenticated attackers
          to invoke protected controller methods via the ajax/api/ad/replaceAdTemplate endpoint,
          due to improper use of PHP's Reflection API in combination with changes in PHP 8.1+.

          Specifically, it targets the vB_Api_Ad::replaceAdTemplate() method to inject a template
          containing a <vb:if> conditional that evaluates attacker-supplied PHP using the
          "system"($_POST[<param>]) construct. The malicious template is then executed via
          a second unauthenticated request to ajax/render/ad_<location>.

          Successful exploitation results in arbitrary command execution as the webserver user,
          without authentication. This module supports payloads for PHP, Linux, and Windows.

          Tested against vBulletin 5.1.0, 5.7.5, 6.0.1, and 6.0.3 running on PHP 8.1.

Check method (fingerprinting):
vprint_status("Starting vulnerability check on #{rhost}:#{rport}#{target_uri.path}")
    inject_and_trigger(:check) ? CheckCode::Vulnerable('Successfully executed the injected code') : CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812)
Type: exploit
Path: modules/exploits/multi/http/wingftp_null_byte_rce.rb
Platform: %w[unix linux
Disclosure date: 2025-06-30
References: CVE-2025-47812, URL-https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
Targets: Unix/Linux Command Shell, Windows Command Shell

Description:
Wing FTP Server allows arbitrary Lua code injection via a NULL-byte (%00) truncation bug (CVE-2025-47812).
          Supplying <valid-user>%00<lua-payload> as the username makes the C++ authentication routine validate only the prefix,
          while the full string is written unfiltered into the session file and later executed with root/SYSTEM privileges,
          leading to Remote Code Execution.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login.html')
    )
    return CheckCode::Safe('Not a Wing FTP Web Client') unless res&.body&.include?('Wing FTP Server - Web Client')

    if (ver_str = res.body[/Wing FTP Server v([\d.]+)/i, 1])
      ver = Rex::Version.new(ver_str)
      return ver < Rex::Version.new('7.4.4') ? CheckCode::Vulnerable("Detected version #{ver} ≤ 7.4.4") : CheckCode::Safe("Detected version #{ver} > 7.4.4")
    end

    suffix = Rex::Text.rand_text_alpha(8)
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']

    res2 = post_login("#{user}%00#{suffix}", pass)
    return CheckCode::Unknown('No response') unless res2

    if uid_cookie(res2)
      CheckCode::Appears('UID cookie received')
    else
      CheckCode::Safe('UID cookie not found; not vulnerable')
    end
  end
Metasploit Module: ManageEngine ServiceDesk Plus Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/manageengine_sd_uploader.rb
Platform: java
Disclosure date: 2015-08-20
References: CVE-2019-8394, ZDI-15-396 , URL-https://github.com/rapid7/metasploit-framework/pull/6038

Description:
This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus.
          The vulnerability exists in the FileUploader servlet which accepts unauthenticated
          file uploads. This module has been tested successfully on versions v9 b9000 - b9102
          in Windows and Linux. The MSP versions do not expose the vulnerable servlet.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => "/",
      'method' => 'GET'
    })

    if res && res.code == 200 &&
       res.body.to_s =~ /src='\/scripts\/Login\.js\?([0-9]+)'><\/script>/
      build = $1
      if build < "9103" && build > "9000"
        return Exploit::CheckCode::Appears("Build #{build} appears to be vulnerable")
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Spreecommerce Arbitrary Command Execution
Type: exploit
Path: modules/exploits/multi/http/spree_searchlogic_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-04-19
References: CVE-2011-10026, OSVDB-71900, URL-http://www.spreecommerce.com/blog/2011/04/19/security-fixes/

Description:
This module exploits an arbitrary command execution vulnerability in
          the Spreecommerce API searchlogic for versions 0.50.0 and earlier.
          Unvalidated input is called via the Ruby send method allowing command
          execution.
Metasploit Module: Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/uptime_file_upload_2.rb
Platform: php
Disclosure date: 2013-11-18
References: CVE-2015-9263 , EDB-37888, URL-http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5254.php

Description:
This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0.

          The vulnerability began as a classic arbitrary file upload vulnerability in post2file.php,
          which can be exploited by exploits/multi/http/uptime_file_upload_1.rb, but it was mitigated
          by the vendor.

          Although the mitigation in place will prevent uptime_file_upload_1.rb from working, it
          can still be bypassed and gain privilege escalation, and allows the attacker to upload file
          again, and execute arbitrary commands.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    unless res
      vprint_error("Connection timed out.")
      return Exploit::CheckCode::Unknown('Could not connect to the target')
    end

    n = Nokogiri::HTML(res.body)
    uptime_text = n.at('//ul[@id="uptimeInfo"]//li[contains(text(), "up.time")]')

    if uptime_text
      version = uptime_text.text.scan(/up\.time ([\d\.]+)/i).flatten.first
      vprint_status("Found version: #{version}")
      if version >= '7.4.0' && version <= '7.5.0'
        return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
      end
    end

    Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/vtiger_php_exec.rb
Platform: php
Disclosure date: 2013-10-30
References: CVE-2013-3591, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats

Description:
vTiger CRM allows an authenticated user to upload files to embed within documents.
          Due to insufficient privileges on the 'files' upload folder, an attacker can upload a PHP
          script and execute arbitrary PHP code remotely.

          This module was tested against vTiger CRM v5.4.0 and v5.3.0.

Check method (fingerprinting):
res = nil
    begin
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/index.php') })
    rescue
      vprint_error("Unable to access the index.php file")
      return CheckCode::Unknown('No response received from the target')
    end

    if res and res.code != 200
      vprint_error("Error accessing the index.php file")
      return CheckCode::Unknown('Unexpected HTTP response status from the target')
    end

    if res.body =~ /<div class="poweredBy">Powered by vtiger CRM - (.*)<\/div>/i
      vprint_status("vTiger CRM version: " + $1)
      case $1
      when '5.4.0', '5.3.0'
        return CheckCode::Appears('The target appears to be a vulnerable version')
      else
        return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end
    end

    return CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Invision Community 5.0.6 customCss RCE
Type: exploit
Path: modules/exploits/multi/http/invision_customcss_rce.rb
Platform: php
Disclosure date: 2025-05-16
References: CVE-2025-47916, URL-https://karmainsecurity.com/KIS-2025-02, URL-https://invisioncommunity.com
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
Invision Community up to and including version 5.0.6 contains a remote code
          execution vulnerability in the theme editor's customCss endpoint. By crafting
          a specially formatted `content` parameter with a `{expression="..."

Check method (fingerprinting):
path = normalize_uri(target_uri.path, 'admin', 'install', 'eula.txt')
    res = send_request_cgi('uri' => path, 'method' => 'GET')
    unless res&.code == 200 && res.body =~ /^ IPS\ ([\d.]+) /
      return CheckCode::Unknown('Unable to retrieve or parse IPS version from EULA')
    end

    version = Rex::Version.new(Regexp.last_match(1))
    print_status("Detected IPS version: #{version}")

    if version.between?(Rex::Version.new('5.0.0'), Rex::Version.new('5.0.6'))
      CheckCode::Appears("IPS version #{version} is vulnerable (≤ 5.0.6)")
    else
      CheckCode::Safe("IPS version #{version} is not vulnerable")
    end
  end
Metasploit Module: CMS Bolt File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/bolt_file_upload.rb
Platform: php
Disclosure date: 2015-08-17
References: CVE-2015-7309, URL-http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html

Description:
Bolt CMS contains a flaw that allows an authenticated remote
          attacker to execute arbitrary PHP code. This module was
          tested on version 2.2.4.

Check method (fingerprinting):
cookie = bolt_login(username, password)
    return Exploit::CheckCode::Detected('The target application was detected but requires authentication') unless cookie

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'bolt'),
      'cookie' => cookie
    )

    if res && res.code == 200 && res.body.include?('Bolt 2.2.4</b>: Sophisticated, lightweight & simple CMS')
      return Exploit::CheckCode::Vulnerable('Successfully verified file upload vulnerability')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Atlassian Confluence WebWork OGNL Injection
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb
Platform: unix
Disclosure date: 2021-08-25
References: CVE-2021-26084, URL-https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25[PII_REDACTED].html, URL-https://jira.atlassian.com/browse/CONFSERVER-67940, URL-https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection/rapid7-analysis, URL-https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md, URL-https://testbnull.medium.com/atlassian-confluence-pre-auth-rce-cve-2021-26084-v%C3%A0-c%C3%A2u-chuy%E1%BB%87n-v%E1%BB%81-%C4%91i%E1%BB%83m-m%C3%B9-khi-t%C3%ACm-bug-43ab36b6c455, URL-https://tradahacking.vn/atlassian-confluence-cve-2021-26084-the-other-side-of-bug-bounty-45ed19c814f6
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits an OGNL injection in Atlassian Confluence's
          WebWork component to execute commands as the Tomcat user.

Check method (fingerprinting):
token1 = rand_text_alphanumeric(8..16)
    token2 = rand_text_alphanumeric(8..16)
    token3 = rand_text_alphanumeric(8..16)

    res = inject_ognl("#{token1}'+'#{token2}'+'#{token3}")

    return CheckCode::Unknown('No response received from the target') unless res

    unless res.code == 200 && res.body.include?("#{token1}#{token2}#{token3}")
      return CheckCode::Safe('Failed to test OGNL injection.')
    end

    CheckCode::Vulnerable('Successfully tested OGNL injection.')
  end
Metasploit Module: Malicious Git HTTP Server For CVE-2[PII_REDACTED]
Type: exploit
Path: modules/exploits/multi/http/git_submodule_command_exec.rb
Disclosure date: 2017-08-10
Authors: timwr
References: CVE-2[PII_REDACTED], URL-https://seclists.org/oss-sec/2017/q3/280
Targets: Automatic

Description:
This module exploits CVE-2[PII_REDACTED], which affects Git
          version 2.7.5 and lower. A submodule of the form 'ssh://' can be passed
          parameters from the username incorrectly. This can be used to inject
          commands to the operating system when the submodule is cloned.

          This module creates a fake git repository which contains a submodule
          containing the vulnerability. The vulnerability is triggered when the
          submodules are initialised.
Metasploit Module: Horde Form File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/horde_form_file_upload.rb
Platform: php
Disclosure date: 2019-03-24
References: CVE-2019-9858, URL-https://www.ratiosec.com/2019/horde-groupware-webmail-authenticated-arbitrary-file-injection-to-rce/

Description:
Horde Groupware Webmail contains a flaw that allows an authenticated remote
          attacker to execute arbitrary PHP code. The exploitation requires the Turba
          subcomponent to be installed.

          This module was tested on Horde versions 5.2.22 and 5.2.17 running Horde Form subcomponent < 2.0.19.
Metasploit Module: Monitorr unauthenticated Remote Code Execution (RCE)
Type: exploit
Path: modules/exploits/multi/http/monitorr_webshell_rce_cve_2020_28871.rb
Platform: php
Disclosure date: 2020-11-16
References: CVE-2020-28871, URL-https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/, URL-https://attackerkb.com/topics/UNlzoDVL3o/cve-2020-28871, EDB-48980
Targets: PHP, Unix Command, Linux Dropper, Windows Command, Windows EXE Dropper

Description:
This module exploits an arbitrary file upload vulnerability and achieving an RCE in the Monitorr application.
          Using a specially crafted request, custom PHP code can be uploaded and injected through endpoint upload.php because of missing input validation.
          Any user privileges can exploit this vulnerability and it results in access to the underlying operating system with the same privileges
          under which the web services run (typically user www-data).
          Monitorr 1.7.6m, 1.7.7d and below are affected.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'assets', 'js', 'version', 'version.txt'),
      'ctype' => 'application/x-www-form-urlencoded'
    })
    if res && res.code == 200 && !res.body.blank?
      # version 0.8.6d is the first release where versioning using version.txt is introduced according the release notes.
      version = Rex::Version.new(res.body)
      return CheckCode::Vulnerable("Monitorr version: #{version}") if version.between?(Rex::Version.new('0.8.6'), Rex::Version.new('1.7.7'))
    end
    CheckCode::Unknown('Received an unexpected response from the target')
  end