DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
BID:28438
Info
DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
| Bugtraq ID: | 28438 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6542 CVE-2008-6541 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 25 2008 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | Timo Breumelhof and Morteza Kerman |
| Vulnerable: |
DotNetNuke DotNetNuke 4.8.1 DotNetNuke DotNetNuke 4.3.5 DotNetNuke DotNetNuke 3.3.5 DotNetNuke DotNetNuke 3.1 .0 DotNetNuke DotNetNuke 3.0.8 DotNetNuke DotNetNuke 3.0.7 DotNetNuke DotNetNuke 2.1.2 DotNetNuke DotNetNuke 2.1.1 DotNetNuke DotNetNuke 1.0.10 e DotNetNuke DotNetNuke 1.0.10 d DotNetNuke DotNetNuke 1.0.9 DotNetNuke DotNetNuke 1.0.8 DotNetNuke DotNetNuke 1.0.7 DotNetNuke DotNetNuke 1.0.6 DotNetNuke DotNetNuke 4.0 |
| Not Vulnerable: |
DotNetNuke DotNetNuke 4.8.2 |
Discussion
DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
DotNetNuke is prone to multiple remote vulnerabilities, including:
- A vulnerability that allows attackers to execute server-side application logic.
- A vulnerability that allows attackers to upload arbitrary files.
An attacker can exploit these issues to compromise the affected application and to upload and execute arbitrary code within the context of the webserver.
Versions prior to DotNetNuke 4.8.2 are vulnerable.
DotNetNuke is prone to multiple remote vulnerabilities, including:
- A vulnerability that allows attackers to execute server-side application logic.
- A vulnerability that allows attackers to upload arbitrary files.
An attacker can exploit these issues to compromise the affected application and to upload and execute arbitrary code within the context of the webserver.
Versions prior to DotNetNuke 4.8.2 are vulnerable.
Exploit / POC
DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
An attacker can use a browser to exploit these issues.
An attacker can use a browser to exploit these issues.
Solution / Fix
DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
Solution:
The vendor has released updates. Please see the references for more information.
Solution:
The vendor has released updates. Please see the references for more information.
References
DotNetNuke Prior to 4.8.2 Multiple Remote Vulnerabilities
References:
References:
- Ability to create dynamic scripts on server (DotNetNuke)
- Administrator account permission escalation (DotNetNuke)
- DotNetNuke Homepage (DotNetNuke)