ColdFusion
Directory map
Summary
Adobe ColdFusion is a commercial web application platform whose older versions (8.x and earlier) carry several critical unauthenticated vulnerabilities. Two stand out for penetration testing: CVE-2010-2861 (directory traversal) and CVE-2009-2265 (unauthenticated RCE).
CVE-2010-2861 affects ColdFusion 9.0.1 and earlier. Several CFM administrative pages accept a locale parameter without validation, allowing ../ traversal to read arbitrary files. The primary target is [cf_root]/lib/password.properties, which contains SHA1-hashed passwords for all configured services (databases, mail, LDAP). The EDB-14641 Python script automates the traversal across multiple vulnerable endpoints. Recovered hashes can be cracked offline to access the ColdFusion Administrator.
CVE-2009-2265 affects ColdFusion 8.0.1 and earlier. The bundled FCKeditor package exposes an unauthenticated file upload endpoint at /CFIDE/scripts/ajax/FCKeditor/.../upload.cfm. The EDB-50057 Python script generates a JSP reverse shell, uploads it via multipart form post, triggers its execution, and cleans up — returning a shell as the ColdFusion service account. Both vulnerabilities are exploitable without credentials and are identified by running searchsploit adobe coldfusion.