Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Quick 'n Easy and Baby ASP servers leak ASP code

CVE-2006-1391 · published 20 years ago
Summary

The Quick 'n Easy Web Server (versions before 3.1.1) and Baby ASP Web Server 2.7.2 can be tricked into sending the original ASP program text to anyone on the internet. By adding a dot or a space in the file name part of a web request, an attacker can view the underlying source code, which may reveal business logic or passwords. Update to the latest versions or apply the vendor's patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
pablo_software_solutions baby_asp_web_server 2.7.2
cpe:2.3:a:pablo_software_solutions:baby_asp_web_server:2.7.2:*:*:*:*:*:*:*
pablo_software_solutions quick_and_easy_web_server 3.0.6
3.1.0
cpe:2.3:a:pablo_software_solutions:quick_and_easy_web_server:3.0.6:*:*:*:*:*:*:*
Original advisory text
The (a) Quick 'n Easy Web Server before 3.1.1 and (b) Baby ASP Web Server 2.7.2 allows remote attackers to obtain the source code of ASP files via (1) . (dot) and (2) space characters in the extens...
The (a) Quick 'n Easy Web Server before 3.1.1 and (b) Baby ASP Web Server 2.7.2 allows remote attackers to obtain the source code of ASP files via (1) . (dot) and (2) space characters in the extension of a URL.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published25 Mar 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-1391 · NVD
Track software like this
Free during beta