CVE-2010-2861

This Metasploit module exploits a directory traversal vulnerability in Adobe ColdFusion (CVE-2010-2861) to read the password.properties file, bypass authentication, and achieve remote code execution by scheduling a malicious task.

This exploit leverages a directory traversal vulnerability in Adobe ColdFusion to read arbitrary files by manipulating the 'locale' parameter in POST requests. It attempts multiple admin page filenames to bypass restrictions and retrieves file contents via HTTP responses.

This repository contains a functional Python 3 port of the CVE-2010-2861 ColdFusion directory traversal exploit. The script sends crafted HTTP POST requests to vulnerable ColdFusion endpoints, leveraging a null-byte injection in the 'locale' parameter to read arbitrary files, such as password.properties.

This Metasploit module exploits a directory traversal vulnerability in Adobe ColdFusion via the 'locale' parameter to retrieve sensitive files like password.properties. It includes fingerprinting to identify vulnerable versions and OS-specific traversal paths.