Coldfusion MX serial number: wide open
Shared hosting companies usually block cfexecute and cfregistry at the sandbox level; but what about cfobject or the createobject function? Coldfusion 5.0 used to have the license serial number in the Server scope. Macromedia immediately recognized the security flaw and removed it in the MX versions. Yet, undocumented coldfusion such as the ServiceFactory object allows anyone to get a hold of the serial number. Perhaps, try to execute the following code:
<cfobject type="JAVA" action="Create" name="o" class="coldfusion.server.ServiceFactory">
<cfdump var="#o.LicenseService.getProperties()#">
<cfdump var="#o.LicenseService.getProperties()#">
TrackBacks
There are no trackbacks for this entry.
Trackback URL for this entry:
http://www.robgonda.com/blog/trackback.cfm?72284DB9-3048-7431-E45ECF1C75B8A896
http://www.robgonda.com/blog/trackback.cfm?72284DB9-3048-7431-E45ECF1C75B8A896
There are no comments for this entry.
[Add Comment]