{"uuid": "add91f98-014c-4b20-b68f-565ebede4956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2004-1134", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/isapi/w3who_query.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"hdm \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a stack buffer overflow in the w3who.dll ISAPI\\n          application. This vulnerability was discovered Nicolas\\n          Gregoire and this code has been successfully tested against\\n          Windows 2000 and Windows XP (SP2). When exploiting Windows\\n          XP, the payload must call RevertToSelf before it will be\\n          able to spawn a command shell.\", \"disclosure_date\": \"2004-12-06\", \"fullname\": \"exploit/windows/isapi/w3who_query\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:58 +0000\", \"name\": \"Microsoft IIS ISAPI w3who.dll Query String Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/isapi/w3who_query.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"windows/isapi/w3who_query\", \"references\": [\"CVE-2004-1134\", \"OSVDB-12258\", \"URL-http://www.exaprobe.com/labs/advisories/esa-2004-1206.html\", \"BID-11820\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Detection\", \"Windows 2000 RESKIT DLL [Windows 2000]\", \"Windows 2000 RESKIT DLL [Windows XP]\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:06.093636Z"}