deardaniel/secdata-raw huggingface dataset:
Metasploit Module: TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access
Type: auxiliary
Path: modules/auxiliary/admin/officescan/tmlisten_traversal.rb
References: OSVDB-48730, CVE-2008-2439, BID-31531, URL-http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1372_Readme.txt

Description:
This module tests for directory traversal vulnerability in the UpdateAgent
        function in the OfficeScanNT Listener (TmListen.exe) service in Trend Micro
        OfficeScan. This allows remote attackers to read arbitrary files as SYSTEM
        via dot dot sequences in an HTTP request.
Metasploit Module: TYPO3 Winstaller Default Encryption Keys
Type: auxiliary
Path: modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb
References: URL-http://typo3winstaller.sourceforge.net/

Description:
This module exploits known default encryption keys found in the TYPO3 Winstaller.
        This flaw allows for file disclosure in the jumpUrl mechanism. This issue can be
        used to read any file that the web server user account has access to view.

        The method used to create the juhash (short MD5 hash) was altered in later versions
        of Typo3. Use the show actions command to display and select the version of TYPO3 in
        use (defaults to the older method of juhash creation).
Metasploit Module: ContentKeeper Web Appliance mimencode File Access
Type: auxiliary
Path: modules/auxiliary/admin/http/contentkeeper_fileaccess.rb
References: CVE-2009-10005, OSVDB-54551, URL-http://www.aushack.com/200904-contentkeeper.txt

Description:
This module abuses the 'mimencode' binary present within
        ContentKeeper Web filtering appliances to retrieve arbitrary
        files outside of the webroot.
Metasploit Module: Nexpose XXE Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
References: URL-http://web.archive.org/web/[PII_REDACTED]1629/https://www.rapid7.com/blog/post/2013/08/16/r7-vuln-2013-07-24/

Description:
Nexpose v5.7.2 and prior is vulnerable to a XML External Entity attack via a number
          of vectors. This vulnerability can allow an attacker to a craft special XML that
          could read arbitrary files from the filesystem. This module exploits the
          vulnerability via the XML API.
Metasploit Module: WordPress Plugin Automatic Config Change to RCE
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_automatic_plugin_privesc.rb
Platform: php
Disclosure date: 2021-09-06
References: CVE-2021-4374, URL-https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin/

Description:
This module exploits an unauthenticated arbitrary wordpress options change vulnerability
          in the Automatic (wp-automatic) plugin <= 3.53.2. If WPEMAIL is provided, the administrator's email
          address will be changed. User registration is
          enabled, and default user role is set to administrator. A user is then created with
          the USER name set. A valid EMAIL is required to get the registration email (not handled in MSF).

Check method (fingerprinting):
return Exploit::CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online?

    # this is for pickup into the vulnerable plugins list
    # check_plugin_version_from_readme('wp-automatic', '3.53.3')

    if set_wp_option(Rex::Text.rand_text_numeric(8..20), Rex::Text.rand_text_numeric(8..20))
      checkcode = Exploit::CheckCode::Vulnerable('SQL injection via WP Automatic plugin confirmed')
    else
      checkcode = Exploit::CheckCode::Safe('WP Automatic plugin is not vulnerable')
      print_error('Automatic not a vulnerable version')
    end
    checkcode
  end
Metasploit Module: Axigen Arbitrary File Read and Delete
Type: auxiliary
Path: modules/auxiliary/admin/http/axigen_file_access.rb
Disclosure date: 2012-10-31
References: US-CERT-VU-586556, CVE-2012-4940, OSVDB-86802

Description:
This module exploits a directory traversal vulnerability in the WebAdmin
          interface of Axigen, which allows an authenticated user to read and delete
          arbitrary files with SYSTEM privileges. The vulnerability is known to work on
          Windows platforms. This module has been tested successfully on Axigen 8.10 over
          Windows 2003 SP2.
Metasploit Module: D-Link DSL 320B Password Extractor
Type: auxiliary
Path: modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb
References: EDB-25252, OSVDB-93013, URL-http://www.s3cur1ty.de/m1adv2013-018

Description:
This module exploits an authentication bypass vulnerability in D-Link DSL 320B
        <=v1.23. This vulnerability allows to extract the credentials for the remote
        management interface.
Metasploit Module: vBulletin Administrator Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb
Disclosure date: 2013-10-09
References: CVE-2013-6129, URL-http://blog.imperva.com/2013/10/threat-advisory-a-vbulletin-exploit-administrator-injection.html, OSVDB-98370, URL-http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5

Description:
This module abuses the "install/upgrade.php" component on vBulletin 4.1+ and 4.5+ to
          create a new administrator account, as exploited in the wild on October 2013. This module
          has been tested successfully on vBulletin 4.1.5 and 4.1.0.
Metasploit Module: Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/http/cfme_manageiq_evm_pass_reset.rb
Disclosure date: Nov 12 2013
Authors: Ramon de C Valle
References: CVE-2013-2050, URL-https://bugzilla.redhat.com/show_bug.cgi?id=959062

Description:
This module exploits a SQL injection vulnerability in the "explorer"
        action of "miq_policy" controller of the Red Hat CloudForms Management
        Engine 5.1 (ManageIQ Enterprise Virtualization Manager 5.0 and earlier) by
        changing the password of the target account to the specified password.
Metasploit Module: ManageEngine Desktop Central Administrator Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb
Disclosure date: 2014-12-31
References: CVE-2014-7862, OSVDB-116554, URL-https://seclists.org/fulldisclosure/2015/Jan/2, URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt

Description:
This module exploits an administrator account creation vulnerability in Desktop Central
          from v7 onwards by sending a crafted request to DCPluginServelet. It has been tested in
          several versions of Desktop Central (including MSP) from v7 onwards.
Metasploit Module: Openbravo ERP XXE Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/admin/http/openbravo_xxe.rb
Disclosure date: 2013-10-30
References: CVE-2013-3617, OSVDB-99141, BID-63431, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats

Description:
The Openbravo ERP XML API expands external entities which can be defined as
          local files. This allows the user to read any files from the FS as the
          user Openbravo is running as (generally not root).

          This module was tested against Openbravo ERP version 3.0MP25 and 2.50MP6.
Metasploit Module: WebNMS Framework Server Credential Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/http/webnms_cred_disclosure.rb
Disclosure date: 2016-07-04
References: CVE-2016-6601, CVE-2016-6602, URL-https://blogs.securiteam.com/index.php/archives/2712, URL-https://seclists.org/fulldisclosure/2016/Aug/54

Description:
This module abuses two vulnerabilities in WebNMS Framework Server 5.2 to extract
          all user credentials. The first vulnerability is an unauthenticated file download
          in the FetchFile servlet, which is used to download the file containing the user
          credentials. The second vulnerability is that the passwords in the file are
          obfuscated with a very weak algorithm which can be easily reversed.
          This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on
          Windows and Linux.
Metasploit Module: JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment
Type: auxiliary
Path: modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb
References: CVE-2010-0738, OSVDB-64171, URL-https://www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now, URL-https://bugzilla.redhat.com/show_bug.cgi?id=574105

Description:
This module uses the DeploymentFileRepository class in the JBoss Application Server
        to deploy a JSP file which then deploys an arbitrary WAR file.
Metasploit Module: D-Link DIR 645 Password Extractor
Type: auxiliary
Path: modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb
References: OSVDB-90733, BID-58231

Description:
This module exploits an authentication bypass vulnerability in DIR 645 < v1.03.
        With this vulnerability you are able to extract the password for the remote
        management.
Metasploit Module: Apache Tomcat AJP File Read
Type: auxiliary
Path: modules/auxiliary/admin/http/tomcat_ghostcat.rb
Disclosure date: 2020-02-20
References: CVE-2020-1938, EDB-48143, URL-http://web.archive.org/web/[PII_REDACTED]2903/https://www.chaitin.cn/en/ghostcat

Description:
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache
          Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection.
          If such connections are available to an attacker, they can be exploited in ways that may be surprising.

          In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP
          Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended
          in the security guide) that this Connector would be disabled if not required. This vulnerability report
          identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application -
          processing any file in the web application as a JSP. Further, if the web application allowed file upload
          and stored those files within the web application (or the attacker was able to control the content of the
          web application by some other means) then this, along with the ability to process a file as a JSP, made
          remote code execution possible.

          It is important to note that mitigation is only required if an AJP port is accessible to untrusted users.
          Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files
          and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were
          made to the default AJP Connector configuration in 9.0.31 to harden the default configuration.
          It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes
          to their configurations.

Check method (fingerprinting):
ghost_cat_response = read_remote_file
    if read_success?(ghost_cat_response)
      return Exploit::CheckCode::Appears("Successfully read file #{datastore['FILENAME']}")
    end

    Exploit::CheckCode::Safe('Target did not return a valid Ghostcat response')
  rescue StandardError => e
    Exploit::CheckCode::Unknown(e.message)
  end
Metasploit Module: Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control
Type: auxiliary
Path: modules/auxiliary/admin/http/atlassian_confluence_auth_bypass.rb
Disclosure date: 2023-10-04
References: CVE-2023-22515, URL-https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html, URL-https://nvd.nist.gov/vuln/detail/CVE-2023-22515, URL-https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis

Description:
This module exploits a broken access control vulnerability in Atlassian Confluence servers leading to an authentication bypass.
          A specially crafted request can be create new admin account without authentication on the target Atlassian server.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/login.action')
    )
    return Exploit::CheckCode::Unknown('No response received from target') unless res
    return Exploit::CheckCode::Safe('Target did not return HTTP 200 on login page') unless res.code == 200

    poweredby = res.get_xml_document.xpath('//ul[@id="poweredby"]/li[@class="print-only"]/text()').first&.text
    return Exploit::CheckCode::Safe('Could not detect Confluence version from page') unless poweredby =~ /Confluence (\d+(\.\d+)*)/

    confluence_version = Rex::Version.new(Regexp.last_match(1))

    vprint_status("Detected Confluence version: #{confluence_version}")

    if confluence_version.between?(Rex::Version.new('8.0.0'), Rex::Version.new('8.3.2')) ||
       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.2')) ||
       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.1'))
      return Exploit::CheckCode::Appears("Exploitable version of Confluence: #{confluence_version}")
    end

    Exploit::CheckCode::Safe("Confluence version: #{confluence_version}")
  end
Metasploit Module: WordPress WP GDPR Compliance Plugin Privilege Escalation
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_gdpr_compliance_privesc.rb
Disclosure date: 2018-11-08
References: URL-https://www.wordfence.com/blog/2018/11/privilege-escalation-flaw-in-wp-gdpr-compliance-plugin-exploited-in-the-wild/, CVE-2018-19207

Description:
The Wordpress GDPR Compliance plugin <= v1.4.2 allows unauthenticated users to set
          wordpress administration options by overwriting values within the database.

          The vulnerability is present in WordPress's admin-ajax.php, which allows unauthorized
          users to trigger handlers and make configuration changes because of a failure to do
          capability checks when executing the 'save_setting' internal action.

          WARNING: The module sets Wordpress configuration options without reading their current
          values and restoring them later.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-gdpr-compliance', '1.4.3')
  end
Metasploit Module: Linksys E1500/E2500 Remote Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb
Disclosure date: 2013-02-05
References: CVE-2018-3953, OSVDB-89912, BID-57760, EDB-24475, URL-http://www.s3cur1ty.de/m1adv2013-004

Description:
Some Linksys Routers are vulnerable to an authenticated OS command injection.
          Default credentials for the web interface are admin/admin or admin/password. Since
          it is a blind os command injection vulnerability, there is no output for the
          executed command. A ping command against a controlled system for can be used for
          testing purposes.
Metasploit Module: WordPress WPLMS Theme Privilege Escalation
Type: auxiliary
Path: modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb
Disclosure date: 2015-02-09
References: CVE-2015-10139

Description:
The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an
          authenticated user of any user level to set any system option due to a lack of
          validation in the import_data function of /includes/func.php.

          The module first changes the admin e-mail address to prevent any
          notifications being sent to the actual administrator during the attack,
          re-enables user registration in case it has been disabled and sets the default
          role to be administrator.  This will allow for the user to create a new account
          with admin privileges via the default registration page found at
          /wp-login.php?action=register.

Check method (fingerprinting):
check_theme_version_from_readme('wplms', '1.8.4.2', '1.5.2')
  end
Metasploit Module: IBM Data Risk Manager Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/ibm_drm_download.rb
Disclosure date: 2020-04-21
References: CVE-2020-4427, CVE-2020-4429, URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md, URL-https://seclists.org/fulldisclosure/2020/Apr/33, URL-https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-ibm-data-risk-manager-cve-2020-4427-cve-2020-4428-cve-2020-4429-and-cve-2020-4430/

Description:
IBM Data Risk Manager (IDRM) contains two vulnerabilities that can be chained by
          an unauthenticated attacker to download arbitrary files off the system.
          The first is an unauthenticated bypass, followed by a path traversal.
          This module exploits both vulnerabilities, giving an attacker the ability to download (non-root) files.
          A downloaded file is zipped, and this module also unzips it before storing it in the database.
          By default this module downloads Tomcat's application.properties files, which contains the
          database password, amongst other sensitive data.
          At the time of disclosure, this is was a 0 day, but IBM later patched it and released their advisory.
          Versions 2.0.2 to 2.0.4 are vulnerable, version 2.0.1 is not.

Check method (fingerprinting):
# at the moment there is no better way to detect AND be stealthy about it
    session_id = Rex::Text.rand_text_alpha(5..12)
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'albatross', 'saml', 'idpSelection'),
      'method' => 'GET',
      'vars_get' => {
        'id' => session_id,
        'userName' => 'admin'
      }
    })
    if res && (res.code == 302)
      return Exploit::CheckCode::Detected('IBM DRM web interface detected')
    end

    Exploit::CheckCode::Unknown('Could not determine if target is IBM DRM')
  end
Metasploit Module: Kaseya VSA Master Administrator Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/http/kaseya_master_admin.rb
Disclosure date: 2015-09-23
References: CVE-2015-6922, ZDI-15-448, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Kaseya/kaseya-vsa-vuln-2.txt, URL-https://seclists.org/bugtraq/2015/Sep/132

Description:
This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new
          Master Administrator account. Normally this page is only accessible via the localhost
          interface, but the application does nothing to prevent this apart from attempting to
          force a redirect. This module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and
          v9.0.0.3.
Metasploit Module: ManageEngine Multiple Products Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/admin/http/manageengine_file_download.rb
Disclosure date: 2015-01-28
References: CVE-2014-7863, OSVDB-117695, URL-https://seclists.org/fulldisclosure/2015/Jan/114, URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_failservlet.txt

Description:
This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet
          on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is
          unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This
          module will attempt to login using the default credentials for the administrator and
          guest accounts; alternatively you can provide a pre-authenticated cookie or a username
          and password combo. For IT360 targets enter the RPORT of the OpManager instance (usually
          8300). This module has been tested on both Windows and Linux with several different
          versions. Windows paths have to be escaped with 4 backslashes on the command line. There is
          a companion module that allows the recursive listing of any directory. This
          vulnerability has been fixed in Applications Manager v11.9 b11912 and OpManager 11.6.
Metasploit Module: Novell File Reporter Agent Arbitrary File Delete
Type: auxiliary
Path: modules/auxiliary/admin/http/novell_file_reporter_filedelete.rb
References: CVE-2011-2750, OSVDB-73729, URL-http://aluigi.org/adv/nfr_2-adv.txt

Description:
NFRAgent.exe in Novell File Reporter allows remote attackers to delete
          arbitrary files via a full pathname in an SRS request with OPERATION set to 4 and
          CMD set to 5 against /FSF/CMD. This module has been tested successfully on NFR
          Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1) on
          Windows platforms.
Metasploit Module: ManageEngine Multiple Products Arbitrary Directory Listing
Type: auxiliary
Path: modules/auxiliary/admin/http/manageengine_dir_listing.rb
Disclosure date: 2015-01-28
References: CVE-2014-7863, OSVDB-117696, URL-https://seclists.org/fulldisclosure/2015/Jan/114, URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_failservlet.txt

Description:
This module exploits a directory listing information disclosure vulnerability in the
          FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It
          makes a recursive listing, so it will list the whole drive if you ask it to list / in
          Linux or C:\ in Windows. This vulnerability is unauthenticated on OpManager and
          Applications Manager, but authenticated in IT360. This module will attempt to login
          using the default credentials for the administrator and guest accounts; alternatively
          you can provide a pre-authenticated cookie or a username / password combo. For IT360
          targets enter the RPORT of the OpManager instance (usually 8300). This module has been
          tested on both Windows and Linux with several different versions. Windows paths have to
          be escaped with 4 backslashes on the command line. There is a companion module that
          allows for arbitrary file download. This vulnerability has been fixed in Applications
          Manager v11.9 b11912 and OpManager 11.6.
Metasploit Module: AD/CS Authenticated Web Enrollment Services Module
Type: auxiliary
Path: modules/auxiliary/admin/http/web_enrollment_cert.rb

Description:
Authenticates to the AD/CS Web enrollment service and allows the user to query templates and create
        certificates based on available templates.
Metasploit Module: Katello (Red Hat Satellite) users/update_roles Missing Authorization
Type: auxiliary
Path: modules/auxiliary/admin/http/katello_satellite_priv_esc.rb
Disclosure date: Mar 24 2014
Authors: Ramon de C Valle
References: CVE-2013-2143, URL-https://bugzilla.redhat.com/show_bug.cgi?id=970849

Description:
This module exploits a missing authorization vulnerability in the
        "update_roles" action of "users" controller of Katello and Red Hat Satellite
        (Katello 1.5.0-14 and earlier) by changing the specified account to an
        administrator account.
Metasploit Module: Mutiny 5 Arbitrary File Read and Delete
Type: auxiliary
Path: modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb
Disclosure date: 2013-05-15
References: CVE-2013-0136, US-CERT-VU-701572, URL-http://web.archive.org/web/[PII_REDACTED]1839/https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities/

Description:
This module exploits the EditDocument servlet from the frontend on the Mutiny 5
          appliance. The EditDocument servlet provides file operations, such as copy and
          delete, which are affected by a directory traversal vulnerability. Because of this,
          any authenticated frontend user can read and delete arbitrary files from the system
          with root privileges. In order to exploit the vulnerability a valid user (any role)
          in the web frontend is required. The module has been tested successfully on the
          Mutiny 5.0-1.07 appliance.