10
CVSSv2

CVE-2018-15961

Published: 25/09/2018 Updated: 04/09/2020
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 1000
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and previous versions, and Update 14 and previous versions have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

adobe coldfusion 11.0

adobe coldfusion 2016

adobe coldfusion 2018

Mailing Lists

Adobe ColdFusion 2018 suffers from a remote shell upload vulnerability ...

Metasploit Modules

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 (Update 14 and earlier), ColdFusion 2016 (Update 6 and earlier), and ColdFusion 2018 (July 12 release) allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion 2018.0.0.310739.

msf > use exploit/multi/http/coldfusion_ckeditor_file_upload
msf exploit(coldfusion_ckeditor_file_upload) > show targets
    ...targets...
msf exploit(coldfusion_ckeditor_file_upload) > set TARGET < target-id >
msf exploit(coldfusion_ckeditor_file_upload) > show options
    ...show and set options...
msf exploit(coldfusion_ckeditor_file_upload) > exploit

Github Repositories

cve-2018-15961

CVE-2018-15961 This is part of Cved: a tool to manage vulnerable docker containers Cved: gitlabcom/git-rep/cved Image source: githubcom/cved-sources/cve-2018-15961 Image author: bintraycom/eaps/coldfusion/cf%3Acoldfusion/201800

Unrestricted file upload in Adobe ColdFusion

CVE-2018-15961 Unrestricted file upload in Adobe ColdFusion POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadcfm HTTP/11 Host: coldfusion:port User-Agent: Mozilla/50 (Windows NT 100; WOW64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/62032029 Safari/53736 Content-Type: multipart/form-data; boundary=---------------------------24464570528145 Content-Leng

PoC in GitHub 2020 CVE-2020-0014 It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android ID: A-1286745

PoC auto collect from GitHub.

PoC in GitHub 2020 CVE-2020-0022 In reassemble_and_dispatch of packet_fragmentercc, there is possible out of bounds write due to an incorrect bounds calculation This could lead to remote code execution over Bluetooth with no additional execution privileges needed User interaction is not needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Andr

Here is a collection about Proof of Concepts of Common Vulnerabilities and Exposures, and you may also want to check out current Contents CVE-2011-2856 CVE-2011-3243 CVE-2013-2618 CVE-2013-6632 CVE-2014-1701 CVE-2014-1705 CVE-2014-1747 CVE-2014-3176 CVE-2014-6332 CVE-2014-7927 CVE-2014-7928 CVE-2015-0072 CVE-2015-0235 CVE-2015-0240 CVE-2015-1233 CVE-2015-1242 CVE-2015-1268 CV

Awesome CVE PoC A curated list of CVE PoCs Here is a collection about Proof of Concepts of Common Vulnerabilities and Exposures, and you may also want to check out awesome-web-security Please read the contribution guidelines before contributing This repo is full of PoCs for CVEs If you enjoy this awesome list and would like to support it, check out my Patreon page :

Recent Articles

Recently-Patched Adobe ColdFusion Flaw Exploited By APT
Threatpost • Lindsey O'Donnell • 09 Nov 2018

An Adobe ColdFusion vulnerability, patched two months ago, was being exploited in the wild by a China-linked APT group, researchers found.
The vulnerability, CVE-2018-15961, is a critical unrestricted file upload bug that could also lead to arbitrary code-execution, researchers at Volexity, who discovered the exploitation, said on Thursday.
“Volexity recently observed active exploitation of a newly patched vulnerability in Adobe ColdFusion, for which no public details or proof-of-c...