CVE-2005-4360

Microsoft Internet Information Services 5.1 - Remote Code Execution via DLL URL Parser

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2005-4360. PoCs published by kokanin, Kozan.

AI-analyzed exploit summary This Perl script exploits CVE-2005-4360, a DoS vulnerability in IIS 5.1, by sending malformed URLs with randomized bad characters to executable directories. The repeated requests cause inetinfo.exe to crash.

Description

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

Exploits (2)

exploitdb WORKING POC VERIFIED
by kokanin · perldoswindows
https://www.exploit-db.com/exploits/1377

This Perl script exploits CVE-2005-4360, a DoS vulnerability in IIS 5.1, by sending malformed URLs with randomized bad characters to executable directories. The repeated requests cause inetinfo.exe to crash.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS 5.1
No auth needed
Prerequisites: Target running IIS 5.1 · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Kozan · cdoswindows
https://www.exploit-db.com/exploits/1376

This exploit targets a denial-of-service (DoS) vulnerability in Microsoft IIS 5.1 by sending malformed HTTP POST requests to the '_vti_bin' directory. The exploit crashes the inetinfo.exe process by sending multiple crafted requests.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Internet Information Server 5.1
No auth needed
Prerequisites: Target must be running Microsoft IIS 5.1 · Execute permissions must be set to 'Scripts & Executables' on the target directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (12)

Core 12
Core References
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_hp
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/419707/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/271
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/alerts/2005/Dec/1015376.html
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/21805
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/2963
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/15921
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Exploit, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/18106

Scores

EPSS 0.8673
EPSS Percentile 99.7%

Details

CWE
CWE-252
Status published
Products (1)
microsoft/internet_information_services 5.1
Published Dec 20, 2005
Tracked Since Feb 18, 2026