CVE-2007-2815

Microsoft IIS Web Server 5.0 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2815. PoCs published by Sha0.

AI-analyzed exploit summary This script exploits an authentication bypass vulnerability in Microsoft IIS by crafting a malicious URL that leverages the 'CiWebhitsfile' parameter to access protected objects without proper authentication.

Description

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Sha0 · bashremotewindows
https://www.exploit-db.com/exploits/4016

This script exploits an authentication bypass vulnerability in Microsoft IIS by crafting a malicious URL that leverages the 'CiWebhitsfile' parameter to access protected objects without proper authentication.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS (versions affected by CVE-2007-2815)
No auth needed
Prerequisites: Access to the target web server · Lynx or similar HTTP client installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/41091
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/2725
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/469238/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/24105
Vendor Advisory vendor-advisory x_refsource_mskb
http://support.microsoft.com/kb/328832

Scores

EPSS 0.7335
EPSS Percentile 99.4%

Details

CWE
CWE-264
Status published
Products (1)
microsoft/internet_information_services 5.0
Published May 22, 2007
Tracked Since Feb 18, 2026