Ok.....this thread is going to retardville in a hurry.

There is no exploit other than your poor solution. You are using the file system objects which are a com library put there for dealing with directories, files, etc. They give access to everything on the drive because of the account you're using to run the scripts. If you want to do a custom solution for writing pages to your server then for god's sake write your own file access component that uses com+, the proper group/account based security, and a real authentication method.

As I said before...the problem is pebcak.