.. / CVE-2018-15961

Exploit for Adobe ColdFusion - Unrestricted File Upload Remote Code Execution (CVE-2018-15961)

Description:

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

Proof of Concept

PoC exploit

Nuclei Template

View the template here CVE-2018-15961.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-15961.yaml
Copy

Try the exploit in a lab environment:

Lab Machine Link
Hack The Box Arctic Go to Practice

References:

https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
https://github.com/xbufu/CVE-2018-15961
http://www.securitytracker.com/id/1041621
https://nvd.nist.gov/vuln/detail/CVE-2018-15961
http://web.archive.org/web/20220309060906/http://www.securitytracker.com/id/1041621