About coldfusion Security

An unexpected climax

Coldfusion is still relatively stable as a web server, but in terms of its security, if it is improperly set, it is easy to cause the entire server to fall, its own services are started as system permissions.

The oldfusion Directory Traversal Vulnerability released a few days ago clearly describes how to exploit the high Vulnerability, but only

HTtp: // www.exploit-db.com/exploits/14641/

InHttp://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07The exploitation methods and remediation methods of almost all versions are provided.

Here, we only show how to obtain the Administrator's password and so on. The real operation is still how to use it after entering the background.

The mickey blog provides detailed usage methods after entering the background. It is strongly recommended that PDF

Http://pentestbox.com/wp-content/uploads/2010/08/ColdFusionReuse later

In the future, you can use the execution plan task to remotely download a text file to the local device and save it as a CFM file to obtain webshell. However, if an error occurs based on the mickey method, the server time will be displayed, if the Administrator redirects the error page, the current time will not be visible.

Click Server Setting --> Setting Summary in the menu, which is displayed in the header.

Report gengrated on Sep get the current server time

Click Debugging & Logging --> Scheduled Tasks to create a new Scheduled task ......