Description
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dnnsoftware | DotNetNuke | ≤ 9.5 | — |
References
- ExploitDB-48124 exploit
- DotNetNuke Official Vendor Homepage product
- Vulnerability Analysis Blog Post technical-description
- VulnCheck Advisory: DotNetNuke 9.5 - Persistent Cross-Site Scripting third-party-advisory