[{"label":"Qty6Z","type":"p","t":"

I found a vulnerability in Microsoft IIS when I was searching about a method to execute an ASP file when we can only upload a JPG file.

","dir":"ltr","sort":0,"cols":[]},{"label":"QimPL","type":"p","t":"

The result was too simple, but interesting! I need only a semicolon between the “.asp” and the “.jpg” to execute an ASP file. So, the answer was “myfilename.asp;,jpg”. I have written some information about this vulnerability in:

","dir":"ltr","sort":0,"cols":[]},{"label":"TsX0T","type":"p","t":"

http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf

","dir":"ltr","sort":0,"cols":[]},{"label":"2tsv-","type":"p","t":"

I’ll try to update this PDF file if there was a need to add or change some information.

","dir":"ltr","sort":0,"cols":[]},{"label":"z5V6x","type":"p","t":"

Description of this vulnerability from Secunia.com is:

","dir":"ltr","sort":0,"cols":[]},{"label":"jyfUc","type":"p","t":"

There are also several websites which wrote about this weakness:

","dir":"ltr","sort":0,"cols":[]},{"label":"HGX4t","type":"p","t":"

1. Secunia Advisory: Microsoft IIS ASP Multiple Extensions Security Bypass

","dir":"ltr","sort":0,"cols":[]},{"label":"uM0Ct","type":"p","t":"

2. Securityfocus: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

","dir":"ltr","sort":0,"cols":[]},{"label":"6Qmdq","type":"p","t":"

3. The Register: Microsoft IIS vuln leaves users open to remote attack

","dir":"ltr","sort":0,"cols":[]},{"label":"HZj2a","type":"p","t":"

4. VUPEN Security: Microsoft IIS File Extension Processing Security Bypass Vulnerability

","dir":"ltr","sort":0,"cols":[]},{"label":"xXICZ","type":"p","t":"

5. Securitytracker: Microsoft Internet Information Services (IIS) Filename Extension Parsing Flaw May Let Users Bypass Security Controls

","dir":"ltr","sort":0,"cols":[]}]