MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely.Referenceshttp://marc.info/?l=bugtraq&m=91763097004101&w=2
