Microsoft's IIS 6 has a badly resolved file name error

iis| Error | microsoft | file name

Test method: In FTP to create a test.asp folder, folder name is test.asp, in this folder upload a hack.jpg, this JPG content can be directly <%=now%> With IE remote access to this hack.jpg, you can find that it is the same as ASP file to run! Obviously, as long as your site program, allowing users to create their own folders and upload pictures, hackers can upload images as an ASP Trojan to run.

WORKAROUND: Set the Execute permission option, directly will have upload permission directory, cancel ASP's running permissions, can solve this problem.