|
|
| |
| DotNetNuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitise user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. |
| |
Credit:
The information has been provided by Ben Hawkes.
|
| |
Vulnerable Systems:
* DotNetNuke version 4.9.3 and prior
Immune Systems:
* DotNetNuke version 4.9.4 and later
The issue occurs due to DotNetNuke not correctly sanitising iframes closed with an open-bracket. The following URL contains an example exploit: http://<site>/ErrorPage.aspx?status=500&error=test%3Ciframe%20src=%22http://www.lateralsecurity.com/XSS.html%22%3C
Vendor Status:
DotNetNuke's bulletin regarding this issue can be found here:
http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno27/tabid/1276/Default.aspx
Disclosure Timeline:
30th April 2009 Reported
22nd May 2009 Published
|
|
|
