DotNetNuke 07.04.00 - Administration Authentication Bypass

criticalseverity

9.8CVSS score

75.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

Impact

Attackers can reinstall the application and escalate privileges to SuperUser, leading to full control over the system.

Fix

Update to version 7.4.1 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/Install/InstallWizard.aspx?__VIEWSTATE
Positive when: contains "Administrative Information" and "Database Information" AND status 200

Run it with nuclei: nuclei -id CVE-2015-2794 -u <target>

The full check

id: CVE-2015-2794

info:
  name: DotNetNuke 07.04.00 - Administration Authentication Bypass
  author: 0xr2r
  severity: critical
  description: |
    The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
  impact: |
    Attackers can reinstall the application and escalate privileges to SuperUser, leading to full control over the system.
  remediation: |
    Update to version 7.4.1 or later to fix the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2015-2794
    - https://www.exploit-db.com/exploits/39777
    - http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
    - http://www.dnnsoftware.com/community/security/security-center
    - https://dotnetnuke.codeplex.com/releases/view/615317
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2015-2794
    cwe-id: CWE-264
    epss-score: 0.75119
    epss-percentile: 0.99514
    cpe: cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dotnetnuke
    product: dotnetnuke
    fofa-query:
      - app="DotNetNuke"
      - app="dotnetnuke"
  tags: cve2015,cve,dotnetnuke,auth-bypass,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Install/InstallWizard.aspx?__VIEWSTATE"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Administrative Information"
          - "Database Information"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from