DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237464);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-48376", "CVE-2025-48377", "CVE-2025-48378");
  script_xref(name:"IAVA", value:"2025-B-0082-S");

  script_name(english:"DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application running on the remote web server is affected by a multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of DNN (formerly DotNetNuke) running on the remote web server is
prior to 9.13.9. It is, therefore, affected by multiple vulnerabilities:

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft 
    ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external 
    url for a site export to then be imported. Version 9.13.9 fixes the issue. (CVE-2025-48376)

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft 
    ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS 
    payload that is triggered by using some module actions. Version 9.13.9 fixes the issue. (CVE-2025-48377)

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft 
    ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those 
    scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue. (CVE-2025-48378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?895152c9");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b4b6b0b0");
  # https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-m4hf-fxcg-cp34
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5646711c");
  script_set_attribute(attribute:"solution", value:
"Upgrade to DNN version 9.13.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48378");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dotnetnuke:dotnetnuke");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dnnsoftware:dotnetnuke");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dotnetnuke_detect.nasl");
  script_require_keys("installed_sw/DNN");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'DNN';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:80, asp:TRUE);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '9.13.9' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_NOTE,
    flags:{'xss':TRUE}
);