Skip to content
OpenAdvisories
Medium · 6.1 Public exploit CVE-2019-12562 EUVD-2019-0729GHSA-5whq-j5qg-wjvp

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

Published Sep 26, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: DotNetNuke.Core Ecosystem: NuGet

Description

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • MAYASEVEN/CVE-2019-12562 ★ 8 · Oct 3, 2019

    Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 | XSS to RCE

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet DotNetNuke.Core < 9.4.0 9.4.0 GHSA-5whq-j5qg-wjvp

References