[Becky G]

https://www.newbedford-ma.gov/CFIDE/admi.../enter.cfm

[MiRP_Anon]

You found a login page? Congrats /sarcasm

[Becky G]

It's coldfusion 8 you have a 30 second time frame to take the salt and password encrypt it to HMAC and then use it to log into the panel, jackass.

[Cognitive]

It's coldfusion 8 you have a 30 second time frame to take the salt and password encrypt it to HMAC and then use it to log into the panel, jackass.

Then do it? It's not impressive unless you actually exploit it.

[Becky G]

I gave it away, and cold fusion is not very impressive. If you guys literally can't figure it out then i think you guys are half minded, I was expecting a "Thanks for the vuln .gov" or something. And i can't just give a login for it because the vuln changes every 30 seconds to a different HMAC.

---

For people who have no clue what is even going on or that need a guide for this for some reason... http://www.blackhatlibrary.net/Coldfusion_hacking

[Flaaffy]

Thanks for the vuln .gov!

but guess what, i dont give a shit! find a vulnerabillity in cisco and then i will be impressed!

[Cognitive]

I gave it away, and cold fusion is not very impressive. If you guys literally can't figure it out then i think you guys are half minded, I was expecting a "Thanks for the vuln .gov" or something. And i can't just give a login for it because the vuln changes every 30 seconds to a different HMAC.

---

For people who have no clue what is even going on or that need a guide for this for some reason... http://www.blackhatlibrary.net/Coldfusion_hacking

Never said I didn't understand the vulnerability. I'm saying how come you don't exploit it yourself, and show you did it? It's one thing to find vulnerabilities, but another to exploit them.

[Becky G]

1. I don't post what I do because i don't post stuff to you guys of what I do because no one needs to know what I do
2. This was a freebie for you guys
You guys try to defend yourselves so much when the only person that i had anger directed towards was MiRP. I didn't post this the rip on Hf, and you guys are just anger posting as if I was directing my post towards you.

[Han.]

By the way you're dodging it and changing the subject, you're clearly not able to exploit it.

[Pendragon]

Never said I didn't understand the vulnerability. I'm saying how come you don't exploit it yourself, and show you did it? It's one thing to find vulnerabilities, but another to exploit them.

He didn't exploit it and "gave it away" because it's patched. He can't exploit it.

Adobe has released patches for everything < CF9 regarding the LFD in the login panel.

[Becky G]

Wow this forum post turned into idiocy. .gov websites are not anything to be proud of on Hf these days nor do people get any props for finding them, so i just posted the vuln.

[Andrew Downsend]

Thanks for the vuln, exploited with no issues. Good job OP.

[Becky G]

Np. I just don't see why people went crazy over this easy vuln.

[The Fail Collective]

Thanks for the vuln, exploited with no issues. Good job OP.

Are you sure? I mean... are you really sure?
Seems like it's not vuln to RFD

[Kavalli †]

Thanks for the vuln .gov!

but guess what, i dont give a shit! find a vulnerabillity in cisco and then i will be impressed!

Why the fuck would he try to impress YOU?