bugtraq - Adobe ColdFusion Information Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <40028ab10701210916v26b43a04gb0c2f66aa1fbf025@mail.gmail.com>
Date: Sun, 21 Jan 2007 19:16:26 +0200
From: "zck zck" <zckzck@...il.com>
To: bugtraq@...urityfocus.com
Subject: Adobe ColdFusion Information Disclosure

Hi people,

I was wondering whether I was right or not about this vuln:
http://www.securityfocus.com/bid/21978

Unfortunately, I don't have a Colfusion to test on.. What I would do is:
http://colfusion-server/an-existing-file.cfm%2500.cfm

and I expect the server to spit out the source code....

Am I right here? Did anybody try this out? If so, how did you do it?
Thank you.

Cheers,
Mateo