deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Car Rental System 1.0 File Upload RCE (Authenticated)
Type: exploit
Path: modules/exploits/multi/http/carrental_fileupload_rce.rb
Platform: php
Disclosure date: 2025-01-13
Authors: Aaryan Golatkar
References: CVE-2024-57487, URL-https://nvd.nist.gov/vuln/detail/CVE-2024-57487

Description:
This module exploits an authenticated remote code execution vulnerability in the
          Online Car Rental System 1.0 via the `changeimage1.php` endpoint. An authenticated
          attacker can upload malicious PHP scripts without proper validation, enabling
          arbitrary code execution on the server.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'admin/'))
    return CheckCode::Unknown('Failed to access the target.') unless res&.code == 200

    if res.body.include?('Car Rental Portal')
      return CheckCode::Detected('The target appears to be the Online Car Rental System.')
    end

    CheckCode::Safe('Online Car Rental System not detected')
  end
Metasploit Module: MyBB Admin Control Code Injection RCE
Type: exploit
Path: modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb
Platform: php
Disclosure date: 2022-03-09
References: URL-https://www.zerodayinitiative.com/advisories/ZDI-22-503/, URL-https://github.com/Altelus1/CVE-2022-24734, CVE-2022-24734
Targets: PHP, Unix (In-Memory), Linux (Dropper), Windows (In-Memory), Windows (Dropper)

Description:
This exploit module leverages an improper input validation
          vulnerability in MyBB prior to `1.8.30` to execute arbitrary code in
          the context of the user running the application.

          MyBB Admin Control setting page calls PHP `eval` function with an
          unsanitized user input. The exploit adds a new setting, injecting the
          payload in the vulnerable field, and triggers its execution with a
          second request. Finally, it takes care of cleaning up and removes the
          setting.

          Note that authentication is required for this exploit to work and the
          account must have rights to add or update settings (typically, myBB
          administrator role).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'vars_get' => { 'intcheck' => 1 }
    })
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    # see https://github.com/mybb/mybb/blob/feature/inc/class_core.php#L307-L310
    unless res.body.include?('&#077;&#089;&#066;&#066;')
      return CheckCode::Unknown("#{peer} - Cannot find MyBB forum running at #{target_uri.path}")
    end

    print_good("MyBB forum found running at #{target_uri.path}")

    return CheckCode::Detected('The target application was detected')
  end
Metasploit Module: Xerte Online Toolkits Arbitrary File Upload - Import Language
Type: exploit
Path: modules/exploits/multi/http/xerte_unauthenticated_importlanguage.rb
Platform: php
Disclosure date: 2025-08-04
References: URL-https://blog.haicen.me/posts/xerte-online-toolkits/, URL-https://www.xerte.org.uk/index.php/en/news/blog/80-news/357-xerte-3-13-en-3-14-important-security-update-now-available
Targets: PHP

Description:
This module exploits an authentication bypass allowing arbitrary
          file upload in versions 3.14 and earlier to upload and execute a shell.

Check method (fingerprinting):
print_status('Performing check')
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'website_code', 'php', 'language', 'import_language.php')
    })
    if res&.code == 200
      if res.body.include?('No valid language definition found in the file!')
        return Exploit::CheckCode::Vulnerable('Successfully verified unauthenticated file upload vulnerability')
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: AVideo WWBNIndex Plugin Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/avideo_wwbnindex_unauth_rce.rb
Platform: php
Disclosure date: 2024-04-09
References: CVE-2024-31819, URL-https://github.com/WWBN/AVideo, URL-https://chocapikk.com/posts/2024/cve-2024-31819
Targets: PHP In-Memory, Unix In-Memory, Windows In-Memory

Description:
This module exploits an unauthenticated remote code execution (RCE) vulnerability
          in the WWBNIndex plugin of the AVideo platform. The vulnerability exists within the
          `submitIndex.php` file, where user-supplied input is passed directly to the `require()`
          function without proper sanitization. By exploiting this, an attacker can leverage the
          PHP filter chaining technique to execute arbitrary PHP code on the server. This allows
          for the execution of commands and control over the affected system. The exploit is
          particularly dangerous because it does not require authentication, making it possible
          for any remote attacker to exploit this vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'follow_redirect' => true
    })
    return CheckCode::Unknown('Failed to connect to the target.') unless res
    return CheckCode::Unknown("Unexpected HTTP response code: #{res.code}") unless res.code == 200

    version_match = res.body.match(/Powered by AVideo ® Platform v([\d.]+)/) || res.body.match(/<!--.*?v:([\d.]+).*?-->/m)
    return CheckCode::Unknown('Unable to extract AVideo version.') unless version_match && version_match[1]

    version = Rex::Version.new(version_match[1])
    plugin_check = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'plugin', 'WWBNIndex', 'submitIndex.php'),
      'method' => 'GET'
    })
    unless plugin_check&.code == 200
      CheckCode::Safe('Vulnerable plugin WWBNIndex was not detected')
    end

    if version.between?(Rex::Version.new('12.4'), Rex::Version.new('14.2'))
      return CheckCode::Appears("Detected vulnerable AVideo version: #{version}, with vulnerable plugin WWBNIndex running.")
    end

    CheckCode::Safe("Detected non-vulnerable AVideo version: #{version}")
  end
Metasploit Module: Gitorious Arbitrary Command Execution
Type: exploit
Path: modules/exploits/multi/http/gitorious_graph.rb
Platform: %w{linux unix}
Disclosure date: 2012-01-19
References: OSVDB-78480, URL-http://gitorious.org/gitorious/mainline/commit/647aed91a4dc72e88a27476948dfbacd5d0bf7ce

Description:
This module exploits an arbitrary command execution vulnerability
          in gitorious. Unvalidated input is passed to the shell allowing
          command execution.
Metasploit Module: PolarBear CMS PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/polarcms_upload_exec.rb
Platform: php
Disclosure date: 2012-01-21
References: CVE-2013-0803, OSVDB-90627
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a file upload vulnerability found in PolarBear CMS
          By abusing the upload.php file, a malicious user can upload a file to a temp
          directory without authentication, which results in arbitrary code execution.

Check method (fingerprinting):
uri = target_uri.path

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'includes', 'jquery.uploadify', 'upload.php')
    })

    if !res or res.code != 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    return Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
Type: exploit
Path: modules/exploits/multi/http/freescout_htaccess_rce.rb
Platform: php
Disclosure date: 2026-03-01
References: CVE-2026-28289, CVE-2026-27636, URL-https://www.ox.security/blog/freescout-rce-cve-2026-28289/, URL-https://www.ox.security/blog/freescout-rce-cve-2026-27636/
Targets: PHP In-Memory, Unix/Linux Command Shell, Linux Dropper, Windows Command Shell, Windows Dropper

Description:
This module exploits an unauthenticated remote code execution vulnerability
          in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()
          function checks for dot-prefixed filenames before stripping Unicode format
          characters (ZWSP U+200B), allowing .htaccess upload via email attachment.

          A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by
          the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the
          attachment is stored as .htaccess. The file uses SetHandler to make itself
          executable as PHP, achieving code execution when requested via HTTP.

          Requires a valid mailbox email address and web-accessible attachment
          storage (storage:link pointing to storage/app/).

Check method (fingerprinting):
res = http_send('uri' => normalize_uri(target_uri.path, 'login'))
    return CheckCode::Unknown('Could not connect to the target.') unless res
    return CheckCode::Safe('Target does not appear to be FreeScout.') unless res.body.to_s.match?(/[Ff]ree[Ss]cout/)

    CheckCode::Detected('FreeScout detected. Version cannot be determined remotely.')
  end
Metasploit Module: Apache Struts ClassLoader Manipulation Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_code_exec_classloader.rb
Platform: %w[linux win
Disclosure date: 2014-03-06
Authors: Matthew Hall <hallm[at]sec-1.com>
References: CVE-2014-0094, CVE-2014-0112, CVE-2014-0114, URL-http://www.pwntester.com/blog/2014/04/24/struts2-0day-in-the-wild/, URL-http://struts.apache.org/release/2.3.x/docs/s2-020.html, URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Update-your-Struts-1-ClassLoader-manipulation-filters/ba-p/6639204, URL-https://github.com/rgielen/struts1filter/tree/develop
Targets: Java, Linux, Windows, Windows / Tomcat 6 & 7 and GlassFish 4 (Remote SMB Resource)

Description:
This module exploits a remote command execution vulnerability in Apache Struts versions
          1.x (<= 1.3.10) and 2.x (< 2.3.16.2). In Struts 1.x the problem is related with
          the ActionForm bean population mechanism while in case of Struts 2.x the vulnerability is due
          to the ParametersInterceptor. Both allow access to 'class' parameter that is directly
          mapped to getClass() method and allows ClassLoader manipulation. As a result, this can
          allow remote attackers to execute arbitrary Java code via crafted parameters.
Metasploit Module: vBulletin widgetConfig RCE
Type: exploit
Path: modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb
Platform: php
Disclosure date: 2019-09-23
References: CVE-2019-16759, URL-https://seclists.org/fulldisclosure/2019/Sep/31, URL-http://web.archive.org/web/[PII_REDACTED]2609/https://blog.sucuri.net/2019/09/zero-day-rce-in-vbulletin-v5-0-0-v5-5-4.html
Targets: Meterpreter (PHP In-Memory), Unix (CMD In-Memory), Windows (CMD In-Memory)

Description:
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code]
          parameter in an ajax/render/widget_php routestring POST request.

Check method (fingerprinting):
rand_str = Rex::Text.rand_text_alpha(8)
    received = execute_command(cmd_payload("echo #{rand_str}"))
    if received && received.body.include?(rand_str)
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ManageEngine OpManager and Social IT Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/opmanager_socialit_file_upload.rb
Platform: java
Disclosure date: 2014-09-27
References: CVE-2014-6034, OSVDB-112276, URL-https://seclists.org/fulldisclosure/2014/Sep/110

Description:
This module exploits a file upload vulnerability in ManageEngine OpManager and Social IT.
          The vulnerability exists in the FileCollector servlet which accepts unauthenticated
          file uploads. This module has been tested successfully on OpManager v8.8 - v11.3 and on
          version 11.0 of SocialIT for Windows and Linux.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("/servlet/com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector"),
      'method' => 'GET'
    })

    # A GET request on this servlet returns "405 Method not allowed"
    if res and res.code == 405
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: OpenMRS Java Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/openmrs_deserialization.rb
Disclosure date: 2019-02-04
References: CVE-2018-19276, URL-https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607, URL-https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization, URL-https://github.com/mpgn/CVE-2018-19276/
Targets: Linux

Description:
OpenMRS is an open-source platform that supplies
          users with a customizable medical record system.

          There exists an object deserialization vulnerability
          in the `webservices.rest` module used in OpenMRS Platform.
          Unauthenticated remote code execution can be achieved
          by sending a malicious XML payload to a Rest API endpoint
          such as `/ws/rest/v1/concept`.

          This module uses an XML payload generated with Marshalsec
          that targets the ImageIO component of the XStream library.

          Tested on OpenMRS Platform `v2.1.2` and `v2.21` with Java
          8 and Java 9.

Check method (fingerprinting):
res = send_request_cgi!('method' => 'GET', 'uri' => normalize_uri(target_uri.path))
    return CheckCode::Unknown('OpenMRS page unreachable.') unless res

    return CheckCode::Safe('Page discovered is not OpenMRS.') unless res.body.downcase.include?('openmrs')

    response = res.get_html_document
    version = response.at('body//h3')
    return CheckCode::Detected('Successfully identified OpenMRS, but cannot detect version') unless version && version.text

    version_no = version.text
    version_no = version_no.match(/\d+\.\d+\.\d*/)
    return CheckCode::Detected('Successfully identified OpenMRS, but cannot detect version') unless version_no

    version_no = Rex::Version.new(version_no)

    if (version_no < Rex::Version.new('1.11.8') || version_no.between?(Rex::Version.new('2'), Rex::Version.new('2.1.3')))
      return CheckCode::Appears("OpenMRS platform version: #{version_no}")
    end

    CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: Mantis manage_proj_page PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/mantisbt_manage_proj_page_rce.rb
Platform: php
Disclosure date: 2008-10-16
References: EDB-6768, CVE-2008-4687

Description:
Mantis v1.1.3 and earlier are vulnerable to a post-authentication Remote
          Code Execution vulnerability in the sort parameter of the
          manage_proj_page.php page.

Check method (fingerprinting):
vprint_status('Checking Mantis version ...')
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'login_page.php'),
      'method' => 'GET'
    })

    unless res
      vprint_error('Connection to host failed!')
      return CheckCode::Unknown('Could not connect to the target')
    end

    unless res.body =~ /Mantis ([0-9]+\.[0-9]+\.[0-9]+)/
      vprint_error('Cannot determine Mantis version!')
      return CheckCode::Unknown('Unable to determine Mantis version from the response')
    end

    version = Rex::Version.new(Regexp.last_match[1])

    vprint_status("Mantis version #{version} detected")

    if res.code == 200 && version <= Rex::Version.new('1.1.3')
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: ManageEngine Security Manager Plus 5.5 Build 5505 SQL Injection
Type: exploit
Path: modules/exploits/multi/http/manageengine_search_sqli.rb
Platform: win
Disclosure date: 2012-10-18
References: OSVDB-86562, EDB-22094, BID-56138
Targets: Windows, Linux

Description:
This module exploits a SQL injection found in ManageEngine Security Manager Plus
          advanced search page, which results in remote code execution under the context of
          SYSTEM in Windows; or as the user in Linux.  Authentication is not required in order
          to exploit this vulnerability.

Check method (fingerprinting):
res = sqli_exec(Rex::Text.rand_text_alpha(1))

    if res and res.body =~ /Error during search/
      return Exploit::CheckCode::Vulnerable('SQL injection condition detected in search response')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: CuteFlow v2.11.2 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/cuteflow_upload_exec.rb
Platform: php
Disclosure date: 2012-07-27
References: CVE-2012-10050, URL-http://web.archive.org/web/[PII_REDACTED]4637/https://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/, OSVDB-84829

Description:
This module exploits a vulnerability in CuteFlow version 2.11.2 or prior.
          This application has an upload feature that allows an unauthenticated
          user to upload arbitrary files to the 'upload/___1/' directory
          and then execute it.

Check method (fingerprinting):
base = normalize_uri(target_uri.path)
    base << '/' if base[-1, 1] != '/'
    res = send_request_raw({
      'method' => 'GET',
      'uri' => base
    })

    if res.body =~ /\<strong style\=\"font\-size\:8pt\;font\-weight\:normal\"\>Version 2\.11\.2\<\/strong\>\<br\>/
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    elsif res.body =~ /\<a href\=\"http\:\/\/cuteflow\.org" target\=\"\_blank\"\>/
      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: Oracle Access Manager unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/oracle_access_manager_rce_cve_2021_35587.rb
Disclosure date: 2022-01-19
References: CVE-2021-35587, URL-https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316, URL-https://twitter.com/testanull/status/[PII_REDACTED]89279744, URL-https://github.com/Y4er/CVE-2020-2883/blob/master/CVE_2020_2883.java, URL-https://www.oracle.com/security-alerts/cpujan2022.html
Targets: Linux Command, Windows Command, Unix Command

Description:
This module exploits an unauthenticated deserialization of untrusted data vulnerability in the OpenSSO
          Agent component of the Oracle Access Manager (OAM) product. The affected product versions are 11.1.2.3.0,
          12.2.1.3.0, and 12.2.1.4.0.

Check method (fingerprinting):
detected_version = get_version

    if detected_version
      detected_description = "Oracle Access Manager #{detected_version}."

      # According to Oracle, these 3 versions are affected.
      affected_versions = [
        '11.1.2.3.0',
        '12.2.1.3.0',
        '12.2.1.4.0'
      ]

      affected_versions.each do |affected_version|
        return CheckCode::Appears(detected_description) if detected_version == Rex::Version.new(affected_version)
      end

      return CheckCode::Safe(detected_description)
    end

    # By here we think the target is OAM, but we did not get a version number from the response body, so
    # we cannot do a version based check to determine if vulnerable or safe.
    CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  rescue Msf::Exploit::Failed => e
    return Exploit::CheckCode::Unknown(e.message)
  end
Metasploit Module: v0pCr3w Web Shell Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/v0pcr3w_exec.rb
Platform: unix
Disclosure date: 2013-03-23
References: OSVDB-91841, URL-https://defense.ballastsecurity.net/wiki/index.php/V0pCr3w_shell, URL-https://defense.ballastsecurity.net/decoding/index.php?hash=f6b534edf37c3cc0aa88997810daf9c0

Description:
This module exploits a lack of authentication in the shell developed by v0pCr3w
          and is widely reused in automated RFI payloads. This module takes advantage of the
          shell's various methods to execute commands.

Check method (fingerprinting):
shell = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path.to_s),
      'vars_get' => {
        'lol' => '1'
      }
    })
    if (shell and shell.body =~ /v0pCr3w<br>/ and shell.body =~ /<br>nob0dyCr3w/)
      return Exploit::CheckCode::Vulnerable('Successfully verified webshell command execution')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Atlassian Confluence Namespace OGNL Injection
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb
Platform: unix
Disclosure date: 2022-06-02
References: CVE-2022-26134, URL-https://jira.atlassian.com/browse/CONFSERVER-79000?src=confmacro, URL-https://gist.githubusercontent.com/bturner-r7/1d0b62fac85235b94f1c95cc4c03fcf3/raw/478e53b6f68b5150eefd53e0956f23d53618d250/confluence-exploit.py, URL-https://github.com/jbaines-r7/through_the_wire, URL-https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
This module exploits an OGNL injection in Atlassian Confluence servers. A specially crafted URI can be used to
          evaluate an OGNL expression resulting in OS command execution.

Check method (fingerprinting):
confluence_version = get_confluence_version
    return CheckCode::Unknown('Failed to determine the Confluence version.') unless confluence_version

    vprint_status("Detected Confluence version: #{confluence_version}")

    confluence_platform = get_confluence_platform
    unless confluence_platform
      return CheckCode::Safe('Failed to test OGNL injection.')
    end

    vprint_status("Detected target platform: #{confluence_platform}")
    CheckCode::Vulnerable('Successfully tested OGNL injection.')
  end
Metasploit Module: X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/x7chat2_php_exec.rb
Platform: php
Disclosure date: 2014-10-27
References: BID-71014, CVE-2014-8998, URL-https://github.com/rapid7/metasploit-framework/pull/4076

Description:
This module exploits a post-auth vulnerability found in X7 Chat versions
          2.0.0 up to 2.0.5.1. The vulnerable code exists on lib/message.php, which
          uses preg_replace() function with the /e modifier. This allows a remote
          authenticated attacker to execute arbitrary PHP code in the remote machine.

Check method (fingerprinting):
res = exec_php('phpinfo(); die();', true)

    if res && res.body =~ /This program makes use of the Zend/
      return Exploit::CheckCode::Vulnerable('PHP code execution confirmed via preg_replace')
    else
      return Exploit::CheckCode::Unknown('Could not verify PHP code execution on the target')
    end
  end