Rob Gonda's Blog

Coldfusion MX serial number: wide open

Shared hosting companies usually block cfexecute and cfregistry at the sandbox level; but what about cfobject or the createobject function? Coldfusion 5.0 used to have the license serial number in the Server scope. Macromedia immediately recognized the security flaw and removed it in the MX versions. Yet, undocumented coldfusion such as the ServiceFactory object allows anyone to get a hold of the serial number. Perhaps, try to execute the following code:

<cfobject type="JAVA" action="Create" name="o" class="coldfusion.server.ServiceFactory">
<cfdump var="#o.LicenseService.getProperties()#">

A little bit about myself

I am CTO for iChameleon Group. I have a bachelor in Computer Science and Engineering from F.A.U, an M.B.A. with specialization in Entrepreneurship from Wayne Huizenga school of Business, and I am an Advanced Certified Coldfusion Developer.

iChameleon Group specializes in cutting edge Rich Internet Application development.

Welcome

Welcome to my blog.

We’ll be discussing mostly Coldfusion MX, SQL Server, Flash Remoting, and Rich Internet Applications.

NOTE: This my personal blog, and the opinions and statements voiced here are my own.

This blog is running version 5.9.003. Contact Blog Owner