Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] Vulnerabilities in Adobe ColdFusion

From: MustLive (mustlivewebsecurity.com.ua)
Date: Fri Jan 28 2011 - 13:44:52 CST

Hello list!

I want to warn you about SQL DB Structure Extraction, Full path disclosure
and Cross-Site Scripting vulnerabilities in Adobe ColdFusion.

The vulnerabilities exist at detailed error report page. At 16.11.2010 I
privately informed Adobe about it, but they ignored my letter.

Affected products:

Vulnerable are possibly all versions of Adobe ColdFusion.


SQL DB Structure Extraction (WASC-13):


Information about SQL query is showed (if this web application is working
with DBMS).

Full path disclosure (WASC-13):


Full path at server is showed.

XSS (WASC-08):

At request to page http://site/page.cfm?id=- with User-Agent “Mozilla<body
onload=alert(document.cookie)>” it was possible to execute code.
Vulnerability worked in 2009 and at 25.02.2010. Now this vulnerability is
fixed (possibly in last versions of ColdFusion).

XSS (WASC-08):


Attack vector via tag script, which worked in 2009 and at 25.02.2010, was
already fixed in last versions of ColdFusion. But it's still possible to
attack via many other vectors (e.g. via tag body).


2008-2010 - found these vulnerabilities at different web sites on ColdFusion
and informed admins (and some admins of these sites potentially could told
Adobe about these issues, as XSS via User-Agent and via tag script were
fixed at time of February 2010).
2010.11.16 - informed developers (Adobe ignored).
2011.01.27 - disclosed at my site.

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/