deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WP Database Backup RCE
Type: exploit
Path: modules/exploits/multi/http/wp_db_backup_rce.rb
Platform: win
Disclosure date: 2019-04-24
References: CVE-2019-25224, URL-https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/
Targets: Windows, Linux

Description:
There exists a command injection vulnerability in the Wordpress plugin
          `wp-database-backup` for versions < 5.2.

          For the backup functionality, the plugin generates a `mysqldump` command
          to execute. The user can choose specific tables to exclude from the backup
          by setting the `wp_db_exclude_table` parameter in a POST request to the
          `wp-database-backup` page. The names of the excluded tables are included in
          the `mysqldump` command unsanitized. Arbitrary commands injected through the
          `wp_db_exclude_table` parameter are executed each time the functionality
          for creating a new database backup are run.

          Authentication is required to successfully exploit this vulnerability.

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    changelog_uri = normalize_uri(target_uri.path, 'wp-content', 'plugins', 'wp-database-backup', 'readme.txt')
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => changelog_uri
    )

    if res && res.code == 200
      version = res.body.match(/=+\s(\d+\.\d+)\.?\d*\s=/)
      return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable') unless version && version.length > 1

      vprint_status("Version of wp-database-backup detected: #{version[1]}")
      return CheckCode::Appears('The target is running a vulnerable version') if Rex::Version.new(version[1]) < Rex::Version.new('5.2')
    end
    CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: WordPress Simple File List Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_simple_file_list_rce.rb
Disclosure date: 2020-04-27
References: CVE-2020-36847, URL-https://www.cybersecurity-help.cz/vdb/SB[PII_REDACTED], URL-https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list, EDB-48349

Description:
Simple File List (simple-file-list) plugin before 4.2.3 for WordPress allows remote unauthenticated attackers
          to upload files within a controlled list of extensions.  However, the rename function does not conform to
          the file extension restrictions, thus allowing arbitrary PHP code to be uploaded first as a png then renamed
          to php and executed.

Check method (fingerprinting):
return CheckCode::Unknown('Could not connect to the target') unless wordpress_and_online?

    # check the plugin version from readme
    check_plugin_version_from_readme('simple-file-list', '4.2.3', '1.0.1')
  end
Metasploit Module: Apache Struts 2 Forced Multi OGNL Evaluation
Type: exploit
Path: modules/exploits/multi/http/struts2_multi_eval_ognl.rb
Platform: unix
Disclosure date: 2020-09-14
References: CVE-2019-0230, CVE-2020-17530, URL-https://cwiki.apache.org/confluence/display/WW/S2-059, URL-https://cwiki.apache.org/confluence/display/WW/S2-061, URL-https://github.com/vulhub/vulhub/tree/master/struts2/s2-059, URL-https://github.com/vulhub/vulhub/tree/master/struts2/s2-061, URL-https://securitylab.github.com/advisories/GHSL-2020-205-double-eval-dynattrs-struts2, URL-https://github.com/ka1n4t/CVE-2020-17530
Targets: Unix Command, Linux Dropper

Description:
The Apache Struts framework, when forced, performs double evaluation of attributes' values assigned to certain tags
          attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a
          tag's attributes are rendered. With a carefully crafted request, this can lead to Remote Code Execution (RCE).

          This vulnerability is application dependant. A server side template must make an affected use of request data to
          render an HTML tag attribute.

Check method (fingerprinting):
num1 = rand(1000..9999)
    num2 = rand(1000..9999)

    res = send_request_cgi(build_http_request(datastore['CVE'], "#{num1}*#{num2}"))
    if res.nil?
      return CheckCode::Unknown('No response received from the target')
    elsif res.body.scan(/(["'])\s*#{(num1 * num2)}\s*\1/).empty?
      return CheckCode::Safe('The target is not vulnerable')
    end

    return CheckCode::Appears('The target appears to be vulnerable based on the response')
  end
Metasploit Module: Atlassian Jira Authenticated Upload Code Execution
Type: exploit
Path: modules/exploits/multi/http/jira_plugin_upload.rb
Platform: java
Disclosure date: 2018-02-22
Authors: Alexander Gonzalez(dubfr33)
References: URL-https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-windows-system/, URL-https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-linux-or-mac-system/, URL-https://developer.atlassian.com/server/framework/atlassian-sdk/create-a-helloworld-plugin-project/
Targets: Java Universal

Description:
This module can be used to execute a payload on Atlassian Jira via
          the Universal Plugin Manager(UPM). The module requires valid login
          credentials to an account that has access to the plugin manager.
          The payload is uploaded as a JAR archive containing a servlet using
          a POST request against the UPM component. The check command will
          test the validity of user supplied credentials and test for access
          to the plugin manager.

Check method (fingerprinting):
login_res = query_login
    if login_res.nil?
      vprint_error('Unable to access the web application!')
      return CheckCode::Unknown('No response received from the target')
    end
    return CheckCode::Unknown('Unexpected HTTP status from the target') unless login_res.code == 200

    @session_id = get_sid(login_res)
    @xsrf_token = login_res.get_html_document.at('meta[@id="atlassian-token"]')
    return CheckCode::Unknown('Missing XSRF token in response') if @xsrf_token.nil? || @xsrf_token['content'].nil?

    @xsrf_token = @xsrf_token['content']

    auth_res = do_auth
    good_sid = get_sid(auth_res)
    good_cookie = "atlassian.xsrf.token=#{@xsrf_token}; #{good_sid}"
    res = query_upm(good_cookie)
    if res.nil?
      vprint_error('Unable to access the web application!')
      return CheckCode::Unknown('No response received from the target')
    elsif res.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    else
      vprint_status('Something went wrong, make sure host is up and options are correct!')
      vprint_status("HTTP Response Code: #{res.code}")
      return Exploit::CheckCode::Unknown('Unexpected HTTP status from the UPM endpoint')
    end
  end
Metasploit Module: Log4Shell HTTP Header Injection
Type: exploit
Path: modules/exploits/multi/http/log4shell_header_injection.rb
Platform: java
Disclosure date: 2021-12-09
References: CVE-2021-44228
Targets: Automatic, Linux

Description:
Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration,
        log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints.

        This module will exploit an HTTP end point with the Log4Shell vulnerability by injecting a format message that
        will trigger an LDAP connection to Metasploit and load a payload.

        The Automatic target delivers a Java payload using remote class loading. This requires Metasploit to run an HTTP
        server in addition to the LDAP server that the target can connect to. The targeted application must have the
        trusted code base option enabled for this technique to work.

        The non-Automatic targets deliver a payload via a serialized Java object. This does not require Metasploit to
        run an HTTP server and instead leverages the LDAP server to deliver the serialized object. The target
        application in this case must be compatible with the user-specified JAVA_GADGET_CHAIN option.

Check method (fingerprinting):
validate_configuration!

    @checkcode = super
  end
Metasploit Module: NAS4Free Arbitrary Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/nas4free_php_exec.rb
Platform: php
Disclosure date: 2013-10-30
References: CVE-2013-3631, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats

Description:
NAS4Free allows an authenticated user to post PHP code to a special HTTP script and have
          the code executed remotely. This module was successfully tested against NAS4Free version
          9.1.0.1.804. Earlier builds are likely to be vulnerable as well.
Metasploit Module: Support Incident Tracker Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/sit_file_upload.rb
Platform: php
Disclosure date: 2011-11-10
References: CVE-2011-3829, CVE-2011-3833, OSVDB-76999, OSVDB-77003, URL-http://web.archive.org/web/[PII_REDACTED]1019/http://secunia.com:80/secunia_research/2011-75, URL-http://web.archive.org/web/[PII_REDACTED]4613/http://secunia.com/secunia_research/2011-79/

Description:
This module combines two separate issues within Support Incident Tracker (<= 3.65)
          application to upload arbitrary data and thus execute a shell. The two issues exist
          in ftp_upload_file.php.
          The first vulnerability exposes the upload dir used to store attachments.
          The second vulnerability allows arbitrary file upload since there is no
          validation function to prevent from uploading any file type.
          Authentication is required to exploit both vulnerabilities.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'], "index.php")

    res = send_request_raw({
      'uri' => uri
    })

    if (res and res.body =~ /SiT! Support Incident Tracker v(\d)\.(\d\d)/)
      ver = [ $1.to_i, $2.to_i ]
      vprint_status("SiT! #{ver[0]}.#{ver[1]}")

      if (ver[0] == 3 and ver[1] == 65)
        return Exploit::CheckCode::Appears("SiT! version #{ver[0]}.#{ver[1]} appears to be vulnerable")
      elsif (ver[0] == 3 and ver[1] < 65)
        return Exploit::CheckCode::Appears("SiT! version #{ver[0]}.#{ver[1]} appears to be vulnerable")
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Sflog! CMS 1.0 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/sflog_upload_exec.rb
Platform: php
Disclosure date: 2012-07-06
References: CVE-2012-10042, OSVDB-83767, EDB-19626
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits multiple design flaws in Sflog 1.0.  By default, the CMS has
          a default admin credential of "admin:secret", which can be abused to access
          administrative features such as blogs management.  Through the management
          interface, we can upload a backdoor that's accessible by any remote user, and then
          gain arbitrary code execution.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    base = File.dirname("#{uri}.")

    res = send_request_raw({ 'uri' => "#{base}/index.php" })

    if !res
      return Exploit::CheckCode::Unknown('No response received from the target')
    elsif res and res.body =~ %r{<input type="hidden" name="sitesearch" value="www\.thebonnotgang\.com/sflog}
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  #
  # login unfortunately is needed, because we need to make sure blogID is set, and the upload
  # script (uploadContent.inc.php) doesn't actually do that, even though we can access it
  # directly.
  #
Metasploit Module: Apache Druid JNDI Injection RCE
Type: exploit
Path: modules/exploits/multi/http/apache_druid_cve_2023_25194.rb
Platform: win
Disclosure date: 2023-02-07
References: CVE-2023-25194, URL-https://hackerone.com/reports/1529790, URL-https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz
Targets: Linux

Description:
This module is designed to exploit the JNDI injection vulnerability
        in Druid. The vulnerability specifically affects the indexer/v1/sampler
        interface of Druid, enabling an attacker to execute arbitrary commands
        on the targeted server.

        The vulnerability is found in Apache Kafka clients versions ranging from
        2.3.0 to 3.3.2. If an attacker can manipulate the sasl.jaas.config
        property of any of the connector's Kafka clients to com.sun.security.auth.module.JndiLoginModule,
        it allows the server to establish a connection with the attacker's LDAP server
        and deserialize the LDAP response. This provides the attacker with the capability
        to execute java deserialization gadget chains on the Kafka connect server,
        potentially leading to unrestricted deserialization of untrusted data or even
        remote code execution (RCE) if there are relevant gadgets in the classpath.

        To facilitate the exploitation process, this module will initiate an LDAP server
        that the target server needs to connect to in order to carry out the attack.

Check method (fingerprinting):
validate_configuration!

    vprint_status('Attempting to trigger the jndi callback...')

    start_service
    res = trigger
    return Exploit::CheckCode::Unknown('No HTTP response was received.') if res.nil?

    retry_until_truthy(timeout: datastore['WfsDelay']) { @search_received }

    return Exploit::CheckCode::Unknown('No LDAP search query was received.') unless @search_received

    report_vuln({
      host: rhost,
      port: rport,
      name: name.to_s,
      refs: references,
      info: "Module #{fullname} found vulnerable host."
    })

    Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
  ensure
    cleanup_service
  end
Metasploit Module: Navigate CMS Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/navigate_cms_rce.rb
Platform: php
Disclosure date: 2018-09-26
References: CVE-2018-17552, CVE-2018-17553

Description:
This module exploits insufficient sanitization in the database::protect
          method, of Navigate CMS versions 2.8 and prior, to bypass authentication.

          The module then uses a path traversal vulnerability in navigate_upload.php
          that allows authenticated users to upload PHP files to arbitrary locations.
          Together these vulnerabilities allow an unauthenticated attacker to
          execute arbitrary PHP code remotely.

          This module was tested against Navigate CMS 2.8.

Check method (fingerprinting):
return CheckCode::Vulnerable('Successfully verified the authentication bypass') if login_bypass

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Phpwiki Ploticus Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phpwiki_ploticus_exec.rb
Platform: php
Disclosure date: 2014-09-11
References: CVE-2014-5519, OSVDB-110576, EDB-34451, URL-https://sourceforge.net/p/phpwiki/code/8974/?page=1, URL-https://seclists.org/fulldisclosure/2014/Aug/77
Targets: Generic (PHP Payload), Linux x86

Description:
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary
          code via command injection.
Metasploit Module: pgAdmin Session Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/pgadmin_session_deserialization.rb
Platform: python
Disclosure date: 2024-03-04
References: CVE-2024-2044, URL-https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/, URL-https://github.com/pgadmin-org/pgadmin4/commit/4e49d752fba72953acceeb7f4aa2e6e32d25853d

Description:
pgAdmin versions <= 8.3 have a path traversal vulnerability within their session management logic that can allow
          a pickled file to be loaded from an arbitrary location. This can be used to load a malicious, serialized Python
          object to execute code within the context of the target application.

          This exploit supports two techniques by which the payload can be loaded, depending on whether or not credentials
          are specified. If valid credentials are provided, Metasploit will login to pgAdmin and upload a payload object
          using pgAdmin's file management plugin. Once uploaded, this payload is executed via the path traversal before
          being deleted using the file management plugin. This technique works for both Linux and Windows targets. If no
          credentials are provided, Metasploit will start an SMB server and attempt to trigger loading the payload via a
          UNC path. This technique only works for Windows targets. For Windows 10 v1709 (Redstone 3) and later, it also
          requires that insecure outbound guest access be enabled.

          Tested on pgAdmin 8.3 on Linux, 7.7 on Linux, 7.0 on Linux, and 8.3 on Windows. The file management plugin
          underwent changes in the 6.x versions and therefor, pgAdmin versions < 7.0 can not utilize the authenticated
          technique whereby a payload is uploaded.

Check method (fingerprinting):
check_version('8.4')
  end
Metasploit Module: JBoss Seam 2 File Upload and Execute
Type: exploit
Path: modules/exploits/multi/http/jboss_seam_upload_exec.rb
Platform: java
Disclosure date: 2010-08-05
References: CVE-2010-1871, URL-https://bugzilla.redhat.com/show_bug.cgi?id=615956, URL-http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html, URL-http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
Targets: Java Universal

Description:
Versions of the JBoss Seam 2 framework < 2.2.1CR2 fails to properly
          sanitize inputs to some JBoss Expression Language expressions.  As a
          result, attackers can gain remote code execution through the
          application server.  This module leverages RCE to upload and execute
          a given payload.

          Versions of the JBoss application server (AS) admin-console are
          known to be vulnerable to this exploit, without requiring authentication.
          Tested against JBoss AS 5 and 6, running on Linux with JDKs 6 and 7.

          This module provides a more efficient method of exploitation - it
          does not loop to find desired Java classes and methods.

Check method (fingerprinting):
vprint_status("#{rhost}:#{rport} Checking for vulnerable JBoss Seam 2")
    uri = target_uri.path
    res = send_request_cgi(
      {
        'uri' => normalize_uri(uri),
        'method' => 'POST',
        'ctype' => datastore['CTYPE'],
        'agent' => datastore['AGENT'],
        'data' => "actionOutcome=/success.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime')}"
      }, datastore['TIMEOUT']
    )
    if (res and res.code == 302 and res.headers['Location'])
      vprint_status('Server sent a 302 with location')
      if (res.headers['Location'] =~ /public\+static\+java\.lang\.Runtime\+java.lang.Runtime.getRuntime%28%29/)
        report_vuln({
          host: rhost,
          port: rport,
          name: "#{name} - #{uri}",
          refs: references,
          info: "Module #{fullname} found vulnerable JBoss Seam 2 resource."
        })
        return Exploit::CheckCode::Vulnerable('Successfully verified remote code execution')
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    else
      return Exploit::CheckCode::Unknown('Received an unexpected response from the target')
    end
  end
Metasploit Module: Apache Struts 2 REST Plugin XStream RCE
Type: exploit
Path: modules/exploits/multi/http/struts2_rest_xstream.rb
Platform: unix
Disclosure date: 2017-09-05
References: CVE-2017-9805, URL-https://struts.apache.org/docs/s2-052.html, URL-https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement, URL-https://github.com/mbechler/marshalsec
Targets: Unix (In-Memory), Windows (In-Memory), Python (In-Memory), PowerShell (In-Memory), Linux (Dropper), Windows (Dropper)

Description:
Apache Struts versions 2.1.2 - 2.3.33 and Struts 2.5 - Struts 2.5.12,
          using the REST plugin, are vulnerable to a Java deserialization attack
          in the XStream library.

Check method (fingerprinting):
return CheckCode::Appears('The target appears to be vulnerable') if execute_command(rand_str)

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ATutor 2.2.4 - Directory Traversal / Remote Code Execution,
Type: exploit
Path: modules/exploits/multi/http/atutor_upload_traversal.rb
Platform: linux
Disclosure date: 2019-05-17
References: CVE-2019-12169, URL-https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit/
Targets: Linux, Windows

Description:
This module exploits an arbitrary file upload vulnerability together with
          a directory traversal flaw in ATutor versions 2.2.4, 2.2.2 and 2.2.1 in
          order to execute arbitrary commands.

          It first creates a zip archive containing a malicious PHP file. The zip
          archive takes advantage of a directory traversal vulnerability that will
          cause the PHP file to be dropped in the root server directory (`htdocs`
          for Windows and `html` for Linux targets). The PHP file contains an
          encoded payload that allows for remote command execution on the
          target server. The zip archive can be uploaded via two vectors, the
          `Import New Language` function and the `Patcher` function. The module
          first uploads the archive via `Import New Language` and then attempts to
          execute the payload via an HTTP GET request to the PHP file  in the root
          server directory. If no session is obtained, the module creates another
          zip archive and attempts exploitation via `Patcher`.

          Valid credentials for an ATutor admin account are required. This module
          has been successfully tested against ATutor 2.2.4 running on Windows 10
          (XAMPP server).

Check method (fingerprinting):
vprint_status('Running check')
    res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'login.php'))

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 302 && res.body.include?('content="ATutor')
      return CheckCode::Safe('Target is not an ATutor application.')
    end

    res = login
    unless res
      return CheckCode::Unknown('Authentication failed')
    end

    unless (res.code == 200 || res.code == 302) && res.body.include?('<title>Home: Administration</title>')
      return CheckCode::Unknown('Failed to authenticate as a user with admin privileges.')
    end

    print_good("Successfully authenticated as user '#{datastore['USERNAME']}'. We have admin privileges!")

    ver_no = nil
    html = res.get_html_document
    info = html.search('dd')
    info.each do |dd|
      if dd.text.include?('Version')
        /(?<ver_no>\d+\.\d+\.\d+)/ =~ dd.text
      end
    end

    @version = ver_no
    unless @version && !@version.to_s.empty?
      return CheckCode::Detected('Unable to obtain ATutor version. However, the project is no longer maintained, so the target is likely vulnerable.')
    end

    @version = Rex::Version.new(@version)
    unless @version <= Rex::Version.new('2.4')
      return CheckCode::Unknown("Target is ATutor with version #{@version}.")
    end

    CheckCode::Appears("Target is ATutor with version #{@version}.")
  end