CVE-1999-0360

MS Site Server 2.0 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-1999-0360. PoCs published by Mnemonix.

AI-analyzed exploit summary This exploit demonstrates how to upload an ASP file to a Microsoft Site Server via a PUT request due to improper permissions on the 'Users' directory. The uploaded file can then be executed via a GET request, leading to remote code execution.

Description

MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Mnemonix · textremotewindows
https://www.exploit-db.com/exploits/20305

This exploit demonstrates how to upload an ASP file to a Microsoft Site Server via a PUT request due to improper permissions on the 'Users' directory. The uploaded file can then be executed via a GET request, leading to remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Site Server (with IIS)
No auth needed
Prerequisites: Access to port 80 on the target server · Anonymous Internet Account (IUSR_machinename) enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=91763097004101&w=2

Scores

EPSS 0.0558
EPSS Percentile 91.9%

Details

Status published
Products (1)
microsoft/site_server 2.0
Published Jan 30, 1999
Tracked Since Feb 18, 2026