title: ColdFusion/Java strange script
body: <p>Just found this weird script on the server of one of my clients. I'm not a CFML pro. Can somebody tell me if is a genuine ColdFusion script or a hacker shell and if so what it does? The name was <code>cf_fun.cfm</code></p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;cfset sf = CreateObject("java", "coldfusion.server.ServiceFactory")&gt;
  &lt;cfset rxml=""&gt;
  
  &lt;cftry&gt;
    &lt;cfscript&gt;
     rxml = XmlNew();
     rxml.xmlRoot = XmlElemNew(rxml,"result");
     rxml.result.XmlText = "0";
    &lt;/cfscript&gt;
  
    &lt;cfswitch expression="#Trim(exec_mode)#"&gt; 
     &lt;cfcase value="encode"&gt; 
      &lt;cfscript&gt;
       sres = sf.DataSourceService.encryptPassword(param);
       rxml.result.XmlChildren[1] = XmlElemNew(rxml,"param");
       rxml.result.param.XmlText = param;
       rxml.result.XmlChildren[2] = XmlElemNew(rxml,"encoded");
       rxml.result.encoded.XmlText = sres;
      &lt;/cfscript&gt;
     &lt;/cfcase&gt; 
  
     &lt;cfcase value="test"&gt; 
      &lt;cfscript&gt;
        sf.DataSourceService.verifyDatasource(param);
      &lt;/cfscript&gt;
     &lt;/cfcase&gt; 
  
     &lt;cfcase value="commit"&gt; 
      &lt;cfscript&gt;
        sf.DataSourceService.load();
      &lt;/cfscript&gt;
     &lt;/cfcase&gt; 
  
     &lt;cfcase value="rollback"&gt; 
      &lt;cfscript&gt;
        sf.DataSourceService.store();
      &lt;/cfscript&gt;
     &lt;/cfcase&gt; 
  
     &lt;cfdefaultcase&gt; 
      &lt;cfthrow message="Invalid command specified" errorCode = "1" &gt;
     &lt;/cfdefaultcase&gt; 
    &lt;/cfswitch&gt; 
  &lt;cfcatch&gt;
      &lt;cfscript&gt;
       rxml = XmlNew();
       rxml.xmlRoot = XmlElemNew(rxml,"result");
       rxml.result.XmlText = "-1";
       rxml.result.XmlChildren[1] = XmlElemNew(rxml,"description");
       rxml.result.description.XmlText = cfcatch.message;
      &lt;/cfscript&gt;
  &lt;/cfcatch&gt;
  &lt;/cftry&gt;
  
  &lt;cfoutput&gt;#rxml#&lt;/cfoutput&gt;
  </code></pre>