Back to search
CVE-2006-6578
Published: Dec 15, 2006
Modified: Aug 7, 2024
PUBLISHED
Description
Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
2036
third-party-advisory
x_refsource_SREASON
20061213 ASP Cmd Shell On IIS 5.1
mailing-list
x_refsource_BUGTRAQ
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now