mailing list archives
Vulnerabilities in Adobe ColdFusion
From: "MustLive" <mustlive () websecurity com ua>
Date: Fri, 28 Jan 2011 21:44:52 +0200
I want to warn you about SQL DB Structure Extraction, Full path disclosure
and Cross-Site Scripting vulnerabilities in Adobe ColdFusion.
The vulnerabilities exist at detailed error report page. At 16.11.2010 I
privately informed Adobe about it, but they ignored my letter.
Vulnerable are possibly all versions of Adobe ColdFusion.
SQL DB Structure Extraction (WASC-13):
Information about SQL query is showed (if this web application is working
Full path disclosure (WASC-13):
Full path at server is showed.
At request to page http://site/page.cfm?id=- with User-Agent “Mozilla<body
onload=alert(document.cookie)>” it was possible to execute code.
Vulnerability worked in 2009 and at 25.02.2010. Now this vulnerability is
fixed (possibly in last versions of ColdFusion).
Attack vector via tag script, which worked in 2009 and at 25.02.2010, was
already fixed in last versions of ColdFusion. But it's still possible to
attack via many other vectors (e.g. via tag body).
2008-2010 - found these vulnerabilities at different web sites on ColdFusion
and informed admins (and some admins of these sites potentially could told
Adobe about these issues, as XSS via User-Agent and via tag script were
fixed at time of February 2010).
2010.11.16 - informed developers (Adobe ignored).
2011.01.27 - disclosed at my site.
I mentioned about these vulnerabilities at my site
Best wishes & regards,
Administrator of Websecurity web site
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Vulnerabilities in Adobe ColdFusion MustLive (Jan 28)