CVE-2001-0986 SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling...
MediumCVSS 5.0
EPSS 48.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft index server | = 2.0 | No fix listed |
References
- 20010914 Security Vulnerability with Microsoft Index Server 2.0(Sample file reveals file info, physical path etc) mailing-list patch vendor-advisory
- 3339 exploit vdb-entry vendor-advisory
- winnt-indexserver-sqlqhit-asp(7125) vdb-entry