CVE-2000-0886: Undefined Security Weakness

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability...

Дырка в IIS (File Request Parsing)

При разборе имени запрашиваемого CGI, можно выполнить приложение .bat или .cmd за счет исопльзования специальных метасимволов...