DotNetNuke 07.04.00 Administration Authentication Bypass

Risk: High
Local: No
Remote: Yes

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Exploit Title: DotNetNuke 07.04.00 Administration Authentication Bypass # Date: 06-05-2016 # Dork: :inurl:/tabid/36/language/en-US/Default.aspx # Exploit Author: Marios Nicolaides # Vendor Homepage: # Software Link: # Version: 07.04.00 # Tested on: Microsoft Windows 7 Professional (64-bit) # Contact: # CVE: CVE-2015-2794 # Category: webapps 1. Description DotNetNuke 07.04.00 does not prevent anonymous users from accessing the installation wizard, as a result a remote attacker can 'reinstall' DNN and get unauthorised access as a SuperUser. Previous versions of DotNetNuke may also be affected. 2. Proof of Concept The exploit can be demonstrated as follows: If the DNN SQL database is in the default location and configuration: - Database Type: SQL Server Express File - Server Name: .SQLExpress - Filename: Database.mdf (This is the default database file of DNN. You can find it at App_DataDatabase.mdf) The following URL will create an account with the username: 'host', password: 'dnnhost': If the DNN SQL database is not in the default configuration then the attacker must know its configuration or be able to brute-force guess it. A. Visit B. Fill in the form and submit it: Username: whatever Password: whateverpassword Email address: (You will get an error msg due to client-side validation, just ignore it) Website Name: Whatever Site Name Database Setup Custom: - Database Type: SQL Server Express File - Server Name: .SQLExpress - This is the SQL Server instance name that we need to find or brute-force guess it in order to complete the installation. - If MSSQL database is accessible you can use auxiliary/scanner/mssql/mssql_ping from MSF to get it. - Filename: Database.mdf - This is the default database file of DNN. You can find it at "App_DataDatabase.mdf". - Tick the box Run Database as a Database Owner C. You will probably get an error. Remove the "__VIEWSTATE=" parameter from the URL and press enter. D. When the installation completes click Visit Website. E. Login with your credentials. 3. Solution: Update to version 07.04.01 4. References: (See 2015-05 (Critical) unauthorized users may create new host accounts)


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019,


Back to Top