Description

Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.

Remediation

References

CVE-2006-6578

Related Vulnerabilities

MySQL Improper Input Validation Vulnerability (CVE-2012-5614)

WordPress Plugin Ad Inserter-Ad Manager & AdSense Ads Remote Code Execution (2.4.21)

WordPress Plugin VideoWhisper Video Presentation 'c_status.php' SQL Injection (1.1)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4939)

Artifactory Incorrect Authorization Vulnerability (CVE-2021-45730)

Severity

High

Classification

CVE-2006-6578

Tags

Missing Update Known Vulnerabilities