Vulnerability record · CVE-2001-0986 · published 14 September 2001
CVE-2001-0986: Microsoft Index Server sample file SQLQHit.asp information disclosure
Microsoft · Index Server
The SQLQHit.asp sample file shipped with Microsoft Index Server 2.0 exposes sensitive information when called directly with a CiScope parameter set to webinfo, extended_fileinfo, extended_webinfo, or fileinfo. It leaks the physical path, file attributes, and portions of source code, which aids reconnaissance and follow-on attacks. The record is old and thin, with no affected version list beyond Index Server 2.0.
Description
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
medium priorityInformation disclosure only, but remotely reachable without authentication and with public exploit material and high EPSS, so it warrants prompt remediation.
What it is
The SQLQHit.asp sample file shipped with Microsoft Index Server 2.0 exposes sensitive information when called directly with a CiScope parameter set to webinfo, extended_fileinfo, extended_webinfo, or fileinfo. It leaks the physical path, file attributes, and portions of source code, which aids reconnaissance and follow-on attacks. The record is old and thin, with no affected version list beyond Index Server 2.0.
Impact
An attacker gains internal path names, file attributes, and fragments of source code, useful for mapping the host and planning further exploitation. No data modification or code execution is provided by this flaw itself.
Attack surface
Reachable remotely over the network by requesting sqlqhit.asp directly with a crafted CiScope parameter; the CVSS vector shows no authentication and no user interaction required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.4816 (98.8th percentile) and a reference is tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.
What to do
- Apply the vendor patch referenced in the SecurityFocus advisory, or remove/disable the SQLQHit.asp sample file from the web root.
- Remove or block access to all Index Server sample files and directories in production deployments.
- Restrict network access to Index Server endpoints to trusted hosts only.
- Verify no other sample scripts remain exposed and audit IIS content directories for leftovers.
Detection
- Search web logs for requests to sqlqhit.asp, especially with CiScope parameters webinfo, extended_fileinfo, extended_webinfo, or fileinfo.
- Alert on any access to known Index Server sample file paths.
- Monitor for scanning patterns that enumerate .asp sample files across the web root.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/214217 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/3339 | ExploitVendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/7125 | |
| http://www.securityfocus.com/archive/1/214217 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/3339 | ExploitVendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/7125 |
Track CVE-2001-0986 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-0986), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
