SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, fi…

published 2001-09-14 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-0968

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 48.2%; EPSS 48.2% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Exploit-DB

SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.

Patch / fix

links 1

securityfocus.com/archive/1/214217 advisory

Timeline

2001-09-14 First public exploit (EDB-21113)
2001-09-14 Published

Exploit prediction

48.16% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-21113 Microsoft Index Server 2.0 - File Information / Full Path Disclosure remote, 2001-09-14
securityfocus.com http://www.securityfocus.com/bid/3339 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

References

securityfocus.com /archive/1/214217
mailing-list, patch, vendor-advisory
securityfocus.com /bid/3339
vdb-entry, exploit, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/7125
vdb-entry

Sources

CVE List CVE-2001-0986
NVD CVE-2001-0986

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary