Description

Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.

Remediation

References

CVE-2006-6578

Related Vulnerabilities

MySQL CVE-2014-6484 Vulnerability (CVE-2014-6484)

Drupal Incorrect Authorization Vulnerability (CVE-2023-31250)

WordPress Plugin SocialGrid 'default_services' Parameter Cross-Site Scripting (2.3)

WordPress Plugin Contact Form DB Cross-Site Scripting (2.8.19)

Claroline Other Vulnerability (CVE-2005-1377)

Severity

High

Classification

CVE-2006-6578

Tags

Missing Update Known Vulnerabilities