medium5.0Public exploit code
CVE-2001-0986
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or po…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Index Server 2.0 - File Information / Full Path Disclosure2001-09-14 · remote · windows · Verified
Impact
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Index Server | Version 2.0 |
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/archive/1/214217
- http://www.securityfocus.com/bid/3339
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7125
- http://www.securityfocus.com/archive/1/214217
- http://www.securityfocus.com/bid/3339
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7125