Summary
This host is installed with DotNetNuke and is prone to redirection weakness and cross site scripting vulnerabilities.
Impact
Successful exploitation will allow attacker to insertion attacks and conduct spoofing and cross-site scripting attacks.
Solution
Upgrade to version 6.2.9 or 7.1.1 or later,
For updates refer to http://dnnsoftware.com
Insight
Multiple flaws are due to,
- Input related to the 'Display Name' field in 'Manage Profile' is not properly sanitised before being used.
- Input passed via the '__dnnVariable' GET parameter to Default.aspx is not properly sanitised before being returned to the user.
- Certain unspecified input is not properly verified before being used to redirect users.
Affected
DotNetNuke versions 6.x before 6.2.9 and 7.x before 7.1.1
Detection
Send a Crafted HTTP GET request and check whether it is able to read the cookie or not.
References
Severity
Classification
-
CVE CVE-2013-3943, CVE-2013-4649, CVE-2013-7335 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities