Exploitation Summary
EIP tracks 1 public exploit for CVE-2016-4264. PoCs published by Dawid Golunski.
AI-analyzed exploit summary This exploit demonstrates an XXE (XML External Entity) injection vulnerability in Adobe ColdFusion <= 11, allowing arbitrary file reading and directory listing via a crafted OOXML document. It includes a Python script to generate a malicious spreadsheet and set up listeners to exfiltrate data.
Description
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploits (1)
This exploit demonstrates an XXE (XML External Entity) injection vulnerability in Adobe ColdFusion <= 11, allowing arbitrary file reading and directory listing via a crafted OOXML document. It includes a Python script to generate a malicious spreadsheet and set up listeners to exfiltrate data.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N