Programming language and web application development platform based on Java. Helps build dynamic and interactive web applications that can be connected to various APIs and databases.
ColdFusion Markup Language is the proprietary programming language used to develop dynamic web applications.
Execute an SQL statement
<cfquery name="myQuery" datasource="myDataSource">
SELECT *
FROM myTable
</cfquery>Iterate through records retrieved from the database
<cfloop query="myQuery">
<p>#myQuery.firstName# #myQuery.lastName#</p>
</cfloop>Enumeration
The methods to identify a web application using ColdFusion are
- Pages use .cfm or .cfc file extension.
- HTTP response headers might indicate the technology.
- Error messages contain specific tags or functions.
- Default files such as
admin.cfmorCIFE/administrator/index.cfm.
Attacking
Many exploits exist for ColdFusion products. Among those Directory Traversal exists because certain versions lack input validation.
Some notable targets for path traversal is the password.properties which is a configuration file that stores encrypted passwords for services and resources ColdFusion uses. Has key-value pairs of the resource name and the encrypted password.
Some versions are also vulnerable to Unauthenticated RCE. This will occur when a feature of the web application allows the exeuction of arbitrary code wihtout authentication