Description
When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.
Remediation
References
Related Vulnerabilities
WordPress Plugin Blunt GA Cross-Site Scripting (4.0.0)
WordPress Plugin DELUCKS SEO Cross-Site Scripting (2.1.7)
Joomla! Core 3.0.0 Cross-Site Scripting (3.0.0)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-43425)
WordPress Plugin Social Share Icons & Social Share Buttons Cross-Site Scripting (3.0.5)