deardaniel/secdata-raw huggingface dataset:
Metasploit Module: GoAutoDial 3.3 Authentication Bypass / Command Injection
Type: exploit
Path: modules/exploits/linux/http/goautodial_3_rce_command_injection.rb
Platform: linux
Disclosure date: 2015-04-21
References: CVE-2015-2843, CVE-2015-2845

Description:
This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3[PII_REDACTED] and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges.

          This module has been tested successfully on GoAutoDial version 3.3[PII_REDACTED].

Check method (fingerprinting):
res = check_version

    unless res
      vprint_error "#{peer} Connection failed"
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200 && res.body =~ /goautodial/
      return CheckCode::Safe('The target is not vulnerable')
    end

    unless res.body =~ /[PII_REDACTED]/
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)
Type: exploit
Path: modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb
Platform: linux
Disclosure date: 2022-05-10
References: CVE-2022-27925, CVE-2022-37042, URL-https://blog.zimbra.com/2022/03/new-zimbra-patches-9-0-0-patch-24-and-8-8-15-patch-31/, URL-https://www.cisa.gov/uscert/ncas/alerts/aa22-228a, URL-https://www.yang99.top/index.php/archives/82/, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31

Description:
This module POSTs a ZIP file containing path traversal characters to
          the administrator interface for Zimbra Collaboration Suite. If
          successful, it plants a JSP-based backdoor within the web directory, then
          executes it.

          The core vulnerability is a path-traversal issue in Zimbra Collaboration Suite's
          ZIP implementation that can result in the extraction of an arbitrary file
          to an arbitrary location on the host.

          This issue is exploitable on the following versions of Zimbra:

          * Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 (and earlier)
          * Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 (and earlier)

          Note that the Open Source Edition is not affected.
Metasploit Module: Astium Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/astium_sqli_upload.rb
Platform: php
Disclosure date: 2013-09-17
References: CVE-2013-10043, OSVDB-88860, EDB-23831

Description:
This module exploits vulnerabilities found in Astium astium-confweb-2.1-25399 RPM and
          lower. A SQL Injection vulnerability is used to achieve authentication bypass and gain
          admin access. From an admin session arbitrary PHP code upload is possible. It is used
          to add the final PHP payload to "/usr/local/astium/web/php/config.php" and execute the
          "sudo /sbin/service astcfgd reload" command to reload the configuration and achieve
          remote root code execution.

Check method (fingerprinting):
# Check version
    vprint_status("Trying to detect Astium")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "en", "content", "index.php")
    })

    if res and res.code == 302 and res.body =~ /direct entry from outside/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: Xplico Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/xplico_exec.rb
Platform: unix
Disclosure date: 2017-10-29
References: CVE-2017-16666, URL-https://pentest.blog/advisory-xplico-unauthenticated-remote-code-execution-cve-2017-16666/, URL-https://www.xplico.org/archives/1538

Description:
This module exploits command injection vulnerability. Unauthenticated users can register a new account and then execute a terminal
          command under the context of the root user.

          The specific flaw exists within the Xplico, which listens on TCP port 9876 by default. The goal of Xplico is extract from an internet
          traffic capture the applications data contained. There is a hidden end-point at inside of the Xplico that allow anyone to create
          a new user. Once the user created through /users/register endpoint, it must be activated via activation e-mail. After the registration Xplico try
          to send e-mail that contains activation code. Unfortunetly, this e-mail probably not gonna reach to the given e-mail address on most of installation.
          But it's possible to calculate exactly same token value because of insecure cryptographic random string generator function usage.

          One of the feature of Xplico is related to the parsing PCAP files. Once PCAP file uploaded, Xplico execute an operating system command in order to calculate checksum
          of the file. Name of the for this operation is direclty taken from user input and then used at inside of the command without proper input validation.

Check method (fingerprinting):
# There is no exact way to understand validity of vulnerability without registering new user as well as trigger the command injection.
    # which is not something we want to do for only check..!
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'users', 'register')
    )
    if res && res.code == 302
      Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: Geutebruck Multiple Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb
Platform: unix
Disclosure date: 2021-07-08
References: CVE-2021-33543, CVE-2021-33544, CVE-2021-33548, CVE-2021-33550, CVE-2021-33551, CVE-2021-33552, CVE-2021-33553, CVE-2021-33554, URL-https://www.geutebrueck.com/index.html, URL-https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/

Description:
This module bypasses the HTTP basic authentication used to access the /uapi-cgi/ folder
          and exploits multiple authenticated arbitrary command execution vulnerabilities within
          the parameters of various pages on Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx,
          EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions <= 1.12.0.27 as
          well as firmware versions 1.12.13.2 and 1.12.14.5. Successful exploitation results in
          remote code execution as the root user.

Check method (fingerprinting):
version = firmware
    if version == false
      return CheckCode::Unknown('Target did not respond with a valid XML response that we could retrieve the version from!')
    end

    rex_version = Rex::Version.new(version)
    vprint_status("Found Geutebruck version #{rex_version}")
    if rex_version <= Rex::Version.new('1.12.0.27') || rex_version == Rex::Version.new('1.12.13.2') || rex_version == Rex::Version.new('1.12.14.5')
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: WeBid converter.php Remote PHP Code Injection
Type: exploit
Path: modules/exploits/linux/http/webid_converter.rb
Platform: php
Disclosure date: 2011-07-05
References: CVE-2011-10011, OSVDB-73609, EDB-17487, URL-http://web.archive.org/web/[PII_REDACTED]0259/http://www.webidsupport.com/forums/showthread.php?3892

Description:
This module exploits a vulnerability found in WeBid version 1.0.2.
          By abusing the converter.php file, a malicious user can inject PHP code
          in the includes/currencies.php script without any authentication, which
          results in arbitrary code execution.

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "docs/changes.txt")
    })

    if res and res.code == 200 and res.body =~ /1\.0\.2 \- 17\/01\/11/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri + "converter.php"
    })

    if res and res.code == 200 and res.body =~ /WeBId.*CURRENCY CONVERTER/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Symantec Web Gateway 5 restore.php Post Authentication Command Injection
Type: exploit
Path: modules/exploits/linux/http/symantec_web_gateway_restore.rb
Platform: unix
Disclosure date: 2014-12-16
References: CVE-2014-7285, OSVDB-116009, BID-71620, URL-http://karmainsecurity.com/KIS-2014-19, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00

Description:
This module exploits a command injection vulnerability found in Symantec Web
          Gateway's setting restoration feature. The filename portion can be used to inject
          system commands into a syscall function, and gain control under the context of
          HTTP service.

          For Symantec Web Gateway 5.1.1, you can exploit this vulnerability by any kind of user.
          However, for version 5.2.1, you must be an administrator.

Check method (fingerprinting):
uri = target_uri.path
    res = send_request_cgi({ 'uri' => normalize_uri(uri, 'spywall/login.php') })

    if res && res.body.include?('Symantec Web Gateway')
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Rancher Server - Docker Exploit
Type: exploit
Path: modules/exploits/linux/http/rancher_server.rb
Platform: linux
Disclosure date: 2017-07-27
Authors: Martin Pizala

Description:
Utilizing Rancher Server, an attacker can create a docker container
          with the '/' path mounted with read/write permissions on the host
          server that is running the docker container. As the docker container
          executes command as uid 0 it is honored by the host operating system
          allowing the attacker to edit/create files owed by root. This exploit
          abuses this to creates a cron job in the '/etc/cron.d/' path of the
          host server.

          The Docker image should exist on the target system or be a valid image
          from hub.docker.com.

          Use `check` with verbose mode to get a list of exploitable Rancher
          Hosts managed by the target system.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'ctype' => 'application/json',
      'headers' => { 'Accept' => 'application/json' }
    )

    if res.nil?
      print_error('Failed to connect to the target')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 401 && res.headers.to_json.include?('X-Rancher-Version')
      print_error('Authorization is required. Provide valid Rancher API Keys.')
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    if res.code == 200 && res.headers.to_json.include?('X-Rancher-Version')
      target_found = false
      target_selected = false

      environments = JSON.parse(res.body)['data']
      environments.each do |e|
        res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, e['id'], 'hosts'),
          'ctype' => 'application/json',
          'headers' => { 'Accept' => 'application/json' }
        )

        hosts = JSON.parse(res.body)['data']
        hosts.each do |h|
          target_found = true
          result = "Rancher Host \"#{h['hostname']}\" (TARGETHOST #{h['id']}) on "
          result << "Environment \"#{e['name']}\" (TARGETENV #{e['id']}) found"

          # flag results when this host is targeted via options
          if datastore['TARGETENV'] == e['id'] && datastore['TARGETHOST'] == h['id']
            target_selected = true
Metasploit Module: Lucee Administrator imgProcess.cfm Arbitrary File Write
Type: exploit
Path: modules/exploits/linux/http/lucee_admin_imgprocess_file_write.rb
Platform: unix
Disclosure date: 2021-01-15
References: CVE-2021-21307, URL-https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020-cve-2021-21307/7643, URL-https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md
Targets: Unix Command, Linux Dropper

Description:
This module exploits an arbitrary file write in Lucee Administrator's
          imgProcess.cfm file to execute commands as the Tomcat user.

Check method (fingerprinting):
# NOTE: This doesn't actually write a file
    res = write_file(rand_text_alphanumeric(8..16), nil)

    return CheckCode::Unknown('Could not determine the target status') unless res

    unless res.code == 500 && res.body.include?("key [IMGSRC] doesn't exist")
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Appears('Lucee Administrator imgProcess.cfm detected.')
  end
Metasploit Module: D-Link DCS-930L Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_dcs_930l_authenticated_remote_command_execution.rb
Platform: unix
Disclosure date: 2015-12-20
References: CVE-2016-11021

Description:
The D-Link DCS-930L Network Video Camera is vulnerable
          to OS Command Injection via the web interface.  The vulnerability
          exists at /setSystemCommand, which is accessible with credentials.
          This vulnerability was present in firmware version 2.01 and fixed
          by 2.12.
Metasploit Module: Klog Server authenticate.php user Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/klog_server_authenticate_user_unauth_command_injection.rb
Platform: linux
Disclosure date: 2020-12-27
References: CVE-2020-35729, EDB-49366, EDB-49474, URL-https://github.com/mustgundogdu/Research/tree/main/KLOG_SERVER, URL-https://docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection
Targets: Linux (x86), Linux (x64), Linux (cmd)

Description:
This module exploits an unauthenticated command injection vulnerability
          in Klog Server versions 2.4.1 and prior.

          The `authenticate.php` file uses the `user` HTTP POST parameter in a call
          to the `shell_exec()` PHP function without appropriate input validation,
          allowing arbitrary command execution as the apache user.

          The sudo configuration permits the apache user to execute any command
          as root without providing a password, resulting in privileged command
          execution as root.

          This module has been successfully tested on Klog Server version 2.4.1
          virtual appliance.

Check method (fingerprinting):
sleep = rand(9..11)
    t1 = Time.now.to_i
    res = execute_command("sleep #{sleep}")
    t2 = Time.now.to_i

    unless res
      return CheckCode::Safe('Connection failed')
    end

    unless res.code == 302 && res.headers['location'].to_s.include?('login.php?error')
      return CheckCode::Safe("Unexpected reply (HTTP #{res.code}). Expected redirect (HTTP 302) to login error page.")
    end

    diff = t2 - t1

    if diff < sleep
      return CheckCode::Safe("No response within the expected period of time (#{sleep} seconds).")
    end

    CheckCode::Vulnerable("Response received after #{diff} seconds.")
  end
Metasploit Module: F5 BIG-IP iControl Authenticated RCE via RPM Creator
Type: exploit
Path: modules/exploits/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800.rb
Platform: unix
Disclosure date: 2022-11-16
References: CVE-2022-41800, URL-https://www.rapid7.com/blog/post/2022/11/16/cve-2022-41622-and-cve-2022-41800-fixed-f5-big-ip-and-icontrol-rest-vulnerabilities-and-exposures/, URL-https://support.f5.com/csp/article/K97843387, URL-https://support.f5.com/csp/article/K13325942

Description:
This module exploits a newline injection into an RPM .rpmspec file
          that permits authenticated users to remotely execute commands.

          Successful exploitation results in remote code execution
          as the root user.
Metasploit Module: PineApp Mail-SeCure livelog.html Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/pineapp_livelog_exec.rb
Platform: unix
Disclosure date: 2013-07-26
References: ZDI-13-184, OSVDB-95779

Description:
This module exploits a command injection vulnerability on PineApp Mail-SeCure
          3.70. The vulnerability exists on the livelog.html component, due to the insecure
          usage of the shell_exec() php function. This module has been tested successfully
          on PineApp Mail-SeCure 3.70.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => my_uri,
      'vars_get' => {
        'cmd' => 'nslookup',
        'nstype' => Rex::Text.encode_base64("A"),
        'hostip' => Rex::Text.encode_base64("127.0.0.1"), # Using 127.0.0.1 in order to accelerate things with the legit command
        'nsserver' => Rex::Text.encode_base64("127.0.0.1")
      }
    })
    if res and res.code == 200 and res.body =~ /NS Query result for 127\.0\.0\.1/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: HPE OneView unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/hpe_oneview_rce.rb
Platform: unix
Disclosure date: 2025-12-16
References: CVE-2025-37164, URL-https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US, URL-https://www.rapid7.com/blog/post/etr-cve-2025-37164-critical-unauthenticated-rce-affecting-hewlett-packard-enterprise-oneview/, URL-https://attackerkb.com/topics/ixWdbDvjwX/cve-2025-37164/rapid7-analysis

Description:
This module exploits an unauthenticated RCE vulnerability, CVE-2025-37164, against Hewlett Packard Enterprise
          (HPE) OneView. All versions below 11.00 are vulnerable (so long as the vendor supplied hotfix has not been
          applied), however some VM product versions do not enable the vulnerable "ID Pools" endpoint, and are not
          exploitable.

Check method (fingerprinting):
# We can pull out the current REST API version number and correlate it back to a major.minor product number
    # based on known values. This is informational only, the check routine will leverage the vulnerability to
    # identify if the target si actually vulnerable. This is due to the vulnerability not being present on
    # some VM versions due to the ID Pool endpoints being disabled.
    res_ver = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'rest', 'appliance', 'version')
    )

    return CheckCode::Unknown('Connection to /rest/appliance/version failed') unless res_ver

    return CheckCode::Unknown("Unexpected /rest/appliance/version response code #{res_ver.code}") unless res_ver.code == 200

    json_ver = JSON.parse(res_ver.body)

    version_string = 'Detected '
    version_string += json_ver['modelNumber'] || 'HPE OneView'
    version_string += ' version '
    version_string += json_ver['softwareVersion'] || 'unknown'

    # We leverage the command execution vulnerability to execute a benign command. We test that this command executed
    # successfully below. Note, we aren't checking the stdout, so we cannot do a proof-of-execution check like
    # "echo $((1+2))" and then test for the result of "3".
    cmd = "echo #{SecureRandom.uuid}"

    res = execute_cmd(cmd, shell: false)

    return CheckCode::Unknown("#{version_string}. Connection failed") unless res

    # The vendor hotfix adds an HTTP rewrite rule to force
Metasploit Module: TP-Link Cloud Cameras NCXXX Bonjour Command Injection
Type: exploit
Path: modules/exploits/linux/http/tp_link_ncxxx_bonjour_command_injection.rb
Platform: linux
Disclosure date: 2020-04-29
Authors: Pietro Oliva <pietroliva[at]gmail.com>
References: URL-https://nvd.nist.gov/vuln/detail/CVE-2020-12109, URL-https://seclists.org/fulldisclosure/2020/May/2, CVE-2020-12109
Targets: TP-Link NC200, NC220, NC230, NC250, TP-Link NC260, NC450

Description:
TP-Link cloud cameras NCXXX series (NC200, NC210, NC220, NC230,
          NC250, NC260, NC450) are vulnerable to an authenticated command
          injection. In all devices except NC210, despite a check on the name length in
          swSystemSetProductAliasCheck, no other checks are in place in order
          to prevent shell metacharacters from being introduced. The system name
          would then be used in swBonjourStartHTTP as part of a shell command
          where arbitrary commands could be injected and executed as root. NC210 devices
          cannot be exploited directly via /setsysname.cgi due to proper input
          validation. NC210 devices are still vulnerable since swBonjourStartHTTP
          did not perform any validation when reading the alias name from the
          configuration file. The configuration file can be written, and code
          execution can be achieved by combining this issue with CVE-2020-12110.
Metasploit Module: Centreon authenticated command injection leading to RCE via broker engine "reload" parameter
Type: exploit
Path: modules/exploits/linux/http/centreon_auth_rce_cve_2025_5946.rb
Platform: unix
Disclosure date: 2025-09-24
References: CVE-2025-5946, URL-https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104, URL-https://attackerkb.com/topics/23D4cUoBZj/cve-2025-5946
Targets: Unix/Linux Command

Description:
Centreon is a platform designed to monitor your cloud and on-premises infrastructure.
          This module exploits an command injection vulnerability using the `broker engine reload` setting
          on the poller configuration page of the Centreon web application. Injecting a malcious payload
          at the `broker engine reload` parameter and restarting the poller triggers this vulnerability.
          You need have admin access at the Centreon Web application in order to execute this RCE.
          This issue affects all Centreon editions >= `19.10.0` and it is fixed in Centreon Web versions
          `24.10.13`, `24.04.18` and `23.10.28`.

Check method (fingerprinting):
version = get_centreon_version
    return CheckCode::Unknown('Can not determine the Centreon version.') if version.nil?

    case version.scan(/^\d+\.\d+/)[0]
    when '24.10'
      return CheckCode::Appears("Centreon version #{version}") if Rex::Version.new(version) < Rex::Version.new('24.10.13')
    when '24.04'
      return CheckCode::Appears("Centreon version #{version}") if Rex::Version.new(version) < Rex::Version.new('24.04.18')
    when '23.10'
      return CheckCode::Appears("Centreon version #{version}") if Rex::Version.new(version) < Rex::Version.new('23.10.28')
    else
      return CheckCode::Appears("Centreon version #{version}") if Rex::Version.new(version) >= Rex::Version.new('19.10.0')
    end

    CheckCode::Safe("Centreon version #{version}")
  end