DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'openssl' require 'set' class MetasploitModule activetimeout payload handler is normally set up and started here but has be...

DNN Information Disclosure Vulnerability

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN formerly DotNetNuke 9.5 version of the embedded...

CVE-2020-11585

CVE-2020-11585 affects DNN (DotNetNuke) 9.5 in the built-in Activity-Feed/Messaging/Userid/Message Center module. A registered user can enumerate arbitrary files in the Admin File Manager (excluding secure folders) by sending themselves a message with a file attached, utilizing an arbitrary small...

DotNetNuke Cookie Deserialization Remote Code Execution Exploit

This Metasploit module exploits a deserialization vulnerability in DotNetNuke DNN versions 5.0.0 through 9.3.0-RC. Vulnerable versions store profile information for users in the DNNPersonalization cookie as XML. The expected structure includes a "type" attribute to instruct the server which type ...

DotNetNuke Cookie Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'openssl' require 'set' class MetasploitModule activetimeout payload handler is normally set up and started here but has be...

DNN cross-site scripting vulnerability (CNVD-2020-13479)

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN 9.4.4 and previous versions of cross-site scripting vulnerability. The...

DNN Path Traversal Vulnerability

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A path traversal vulnerability exists in DNN 9.4.4 and earlier versions. The...

DNN Code Issue Vulnerability

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A code issue vulnerability exists in DNN 9.4.4 and prior versions. The...

CVE-2020-5186

DNN formerly DotNetNuke through 9.4.4 allows XSS issue 1 of 2...

CVE-2020-5188

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

CVE-2020-5187

DNN formerly DotNetNuke through 9.4.4 allows Path Traversal issue 2 of 2...

CVE-2020-5187

DNN formerly DotNetNuke through 9.4.4 allows Path Traversal issue 2 of 2...

CVE-2020-5186

DNN formerly DotNetNuke through 9.4.4 allows XSS issue 1 of 2...

CVE-2020-5188

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

Path traversal

DNN formerly DotNetNuke through 9.4.4 allows Path Traversal issue 2 of 2...

Design/Logic Flaw

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

CVE-2020-5186

CVE-2020-5186 maps to a DNN (DotNetNuke) XSS issue in versions up to 9.4.4. The core description in the initial document states XSS (issue 1 of 2) for DNN 9.4.4. Connected documents corroborate a DNN XSS vulnerability; no explicit exploitation details, impact metrics, or patched version are provi...

CVE-2020-5187

CVE-2020-5187 affects DNN (DotNetNuke) up to version 9.4.4, where path traversal was reported. Multiple connected sources describe a zip-slip/path-traversal issue arising from unsafe handling/validation of file paths during archive extraction, enabling an attacker to access or overwrite files out...

CVE-2020-5188

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

CVE-2020-5188

CVE-2020-5188 affects DNN (DotNetNuke) up to version 9.4.4, where an insecure permissions issue is reported. The root cause is improper/weak permission handling within the DNN platform, enabling a scenario where an attacker could abuse file permissions (as indicated by CVSS details with high inte...