Microsoft SQL Server 2000 - 'SQLXML' Buffer Overflow (PoC)

source: https://www.securityfocus.com/bid/5004/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default, SQLXML ISAPI extensions run with LocalSystem privileges.

A buffer overflow issue has been discovered in the SQLXML ISAPI extension that handles data queries over HTTP(SQLXML HTTP).

It is possible for a user to initiate the overflow by connecting to a host and submitting malformed data.

This issue has been reported to exist in SQL Server 2000 Gold, other versions may be vulnerable as well. 

IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA

This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash.