Improper Access Control in Adobe ColdFusion

Repository contains two files: a README and a single Python exploit script. The README documents CVE-2025-43564 as an unauthenticated Apache Tomcat partial PUT handling RCE affecting multiple Tomcat branches and explains the attack concept, affected versions, mitigation guidance, and references. The operational logic is entirely in `exploit.py`. `exploit.py` is a standalone Python 3 proof-of-concept exploit using only the standard library (`argparse`, `urllib`). Its workflow is: (1) construct a PUT request to `<target>/exec.jsp`, (2) upload a hardcoded JSP webshell payload, and (3) invoke the uploaded webshell with `?cmd=<command>` to execute arbitrary system commands. It also offers an interactive pseudo-shell mode that repeatedly sends commands over HTTP. The exploit checks common HTTP responses (200/201/204 success, 403/404/405 failure cases) and prints status messages. Main exploit capability: unauthenticated remote code execution on a vulnerable Tomcat server by planting a JSP webshell in a web-accessible path. The payload is hardcoded rather than customizable beyond the command parameter, so maturity is best classified as OPERATIONAL rather than weaponized. No external C2, persistence, privilege escalation, or lateral movement logic is present; the repository is narrowly focused on initial exploitation and command execution over HTTP.