Mailing List Archive: coldfusion_double_encoded_null_info

On Mar 3, 2008, at 2:47 PM, Dennis Jackson wrote:

> There is an error in the list of files that
> coldfusion_double_encoded_null_info_disclosure.nasl tries to get
> (when being paranoid).
>
> The third item in the list
>
> if (isnull(files)) files = make_list("/index.asp", "/Default.asp",
> "index.aspx", "/Default.aspx");
>
> should have a leading /.

Fixed. Thanks.

> Also, the list could be extended to include /../../../../wwwroot/
> iisstart.asp

Is this sort of request normal or does it exploit a directory
traversal vulnerability?

George
--
theall@tenablesecurity.com

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers