critical9.8Public exploit code
CVE-2015-2794
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DotNetNuke 07.04.00 - Administration Authentication Bypass2016-05-06 · webapps · asp · Verified
Impact
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dnnsoftware | Dotnetnuke | through 07.04.00 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
- http://www.dnnsoftware.com/community/security/security-center
- http://www.securityfocus.com/bid/96373
- https://dotnetnuke.codeplex.com/releases/view/615317
- https://www.exploit-db.com/exploits/39777/
- http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
- http://www.dnnsoftware.com/community/security/security-center
- http://www.securityfocus.com/bid/96373
- https://dotnetnuke.codeplex.com/releases/view/615317
- https://www.exploit-db.com/exploits/39777/