DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
BID:61809
Info
DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
| Bugtraq ID: | 61809 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-3943 CVE-2013-7335 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 16 2013 12:00AM |
| Updated: | Mar 17 2014 01:15AM |
| Credit: | Shubham Mittal via Secunia and Amir Azam of ProCheckUp Ltd. |
| Vulnerable: |
DotNetNuke DotNetNuke 6.0.2 DotNetNuke DotNetNuke 6.0.1 DotNetNuke DotNetNuke 6.1.4 DotNetNuke DotNetNuke 6.1.3 DotNetNuke DotNetNuke 6.1.2 DotNetNuke DotNetNuke 6.1.0 DotNetNuke DotNetNuke 6.0 |
| Not Vulnerable: | |
Discussion
DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
DotNetNuke is prone to an open-redirection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
Versions prior to DotNetNuke 6.2.9 and 7.1.1 are vulnerable.
DotNetNuke is prone to an open-redirection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
Versions prior to DotNetNuke 6.2.9 and 7.1.1 are vulnerable.
Exploit / POC
DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
An attacker can exploit this issue using a web browser. The attacker can exploit the open-redirection vulnerability by enticing an unsuspecting victim into following a malicious URI.
An attacker can exploit this issue using a web browser. The attacker can exploit the open-redirection vulnerability by enticing an unsuspecting victim into following a malicious URI.
Solution / Fix
DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
DotNetNuke Open-Redirection and HTML Injection Vulnerabilities
References:
References:
- DotNetNuke Homepage (DotNetNuke)