Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable (eg. \cgi-bin) are not vulnerable to this exploit.
"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results.
Zeus Technologies Zeus Web Server Null Byte Request CGI Source Disclosure
Remote / Network Access
Loss of Confidentiality
Zeus Web Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when adding specific characters at the end of an URL pointing to a CGI script, which will disclose the source code of the CGI script resulting in a loss of confidentiality.
Upgrade to version 3.3.5a or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.