Comments on: ColdFusion shared hosting security and databases

By: Leigh

Leigh — Sat, 14 Nov 2009 02:35:04 +0000

Re: “The way to decrypt these passwords is well known” .. and apparently still works in ColdFusion 9.

By: “it could be bunnies” » Blog Archive » Shared hosting security wishlist

Tue, 06 Jan 2009 20:26:42 +0000

[...] « ColdFusion shared hosting security and databases [...]

By: Jochem

Jochem — Tue, 06 Jan 2009 09:12:50 +0000

As I explained in an earlier post giving people the option to instantiate Java objects amounts to giving them the password to the ColdFusion Administrator. Who cares that you can enumerate the list of datasources using Java, when you can simple overwrite the password.properties file and force ColdFusion to read the new version by restarting JRun through CreateObject(”java”, “java.lang.runtime”).getRunTime().halt()?

By: Freelance Web Developer

Freelance Web Developer — Mon, 05 Jan 2009 22:46:28 +0000

What about something like this to get all of the datasources?

/**
* Gets a list of DSNs.
*
* @return Returns an array.
* @author Raymond Camden (ray@camdenfamily.com)
* @version 1, November 15, 2002
*/
function getDSNs() {
var factory = createObject(”java”,”coldfusion.server.ServiceFactory”);
return factory.getDataSourceService().getNames();
}

From there you can make a cfquery and go to town.