[6372] in bugtraq
MS Personal Web Server
daemon@ATHENA.MIT.EDU (Lynn Kyle)
Sun Mar 22 15:04:47 1998
Date: Sun, 22 Mar 1998 10:15:01 -0700
Reply-To: Lynn Kyle <lynn@RAINC.COM>
From: Lynn Kyle <lynn@RAINC.COM>
To: BUGTRAQ@NETSPACE.ORG
Has this been reported?
The MS Personal Web Server (tried on the win95, not NT) suffers
from the old IIS 3.0 unpatched bug of allowing you to download
asp files by using a trailing ".".
e.g.,
telnet victim 80
GET /default.asp. HTTP/1.0
will give you the contents of the asp not the result.
oops for any of you embedding a db login/pass in the asp.
Mike
