CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-09-30 12:04:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Relax http.parse_form to allow forms without an action

Browse source 
Patch from nnposter: http://seclists.org/nmap-dev/2014/q3/384
This commit is contained in:
dmiller 2014-09-18 03:38:23 +00:00
parent d518e2dbcb
commit 327496d50c
7 changed files with 6 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/http-sql-injection.nse
View file

@ -247,7 +247,7 @@ action = function(host, port)
for _,form_plain in ipairs(all_forms) do
local form = http.parse_form(form_plain)
local path = r.url.path
if form then
if form and form.action then
local vulnerable_fields = check_form(form, host, port, path)
if #vulnerable_fields > 0 then
vulnerable_fields["name"] = "Form at path: "..path..", form's action: "..form["action"]..". Fields that might be vulnerable:"