ZimLFI-Hunter (CVE-2025-68645)

ZimLFI-Hunter is a professional Proof-of-Concept (PoC) scanner designed to identify the CVE-2025-68645 vulnerability in Zimbra Collaboration Suite. This tool detects Local File Inclusion (LFI) flaws through the /h/printcalendar endpoint.

🛡️ Vulnerability Overview

The vulnerability exists due to improper path normalization in certain Zimbra servlets, allowing an unauthenticated attacker to include and read internal files (such as web.xml, localconfig.xml, etc.) by manipulating the javax.servlet.include.servlet_path parameter.

🚀 Features

• ASCII Art Banner: Pro terminal interface.
• Stealth Scanning: Implements basic bypass techniques (Semicolon, Encoding).
• Real-time Feedback: Status tracking for each payload.
• Colorized Output: Easy-to-read vulnerability detection.

⚙️ Installation

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/Gh0st/ZimLFI-Hunter.git
   cd ZimLFI-Hunter
   

Install dependencies:

pip install -r requirements.txt

🛠️ Usage Simply run the script and provide the target URL:

python zimlfi_hunter.py -u https://target-zimbra.com