DotNetNuke DNNarticle Module 11 – Directory Traversal

• Exploit Database
• 14 阅读

• 作者： Esmaeil Rahimian
  日期： 2018-04-06
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44414/

•  ##############################
  
  01. ### Advisory Information ###
  Title: Directory Traversal Vulnerability in DNNarticle module
  Date published: n/a
  Date of last update: n/a
  Vendors contacted: zldnn.com
  Discovered by: Esmaeil Rahimian
  Severity: Critical
  
  02. ### Vulnerability Information ###
  
  OVE-ID: CVE-2018-9126.
  
  03. ### Introduction ###
  
  DNN Article is not only a powerful module to enable post and manage
  articles, but also provides total solutions for content management. Content
  such as articles, news, announcements, product catalogs, etc can be
  organized into unlimited levels of categories. New content can be moderated
  before published. The administrator can assign roles as moderator. Also an
  email can be sent when new content is added. Visitors can make comment and
  rating. They can also agree or disagree an article.The product supports
  common features of DotNetNuke module such as localization, portable
  interface, search, Syndication etc. It can integrate with Twitter,
  Facebook, Google Map, Windows Live Writer and DotNetNuke Journal to provide
  more powerful functions for your portals. DNNArticle is an extendable
  system. There are several sub modules shipped with DNNArticle standard
  edition to provide rich and attractive look and feel experiences. There are
  also several optional sub modules that provide more features. And the
  number of optional sub modules is growing continually. There are also
  several applications based on DNNArticle such as DNNArticle Blog and
  DNNArticle Product. DNNArticle fully supports template and CSS theme. This
  feature provides more flexibility for users to build more attractive user
  interface.
  
  zldnn.com
  
  04. ### Vulnerability Description ###
  
  The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote
  attackers to read the web.config file, and consequently
  discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
  
  
  05. ### Technical Description / Proof of Concept Code ###
  desktopmodules/DNNArticle/GetCSS.ashx/?CP=%2fweb.config&smid=512&portalid=3
  with this link the attacker can see the web.config file and find DB name
  and see the user name and passwords of DB
  
  06. ###Affected Product Code Base ###
  DnnArticle Module for DotNet Nuke - 11
  Affected Component:
  DNNArticle Module
  [Attack Type]
  Remote
  [Impact Information Disclosure]
  True
  [Attack Vectors]
  Attacker can see the web.config file that contain critical information
  06. ### Credits ###
  
  SecureHost[Research Team] - www.securehost.co
  
  This vulnerability has been discovered by:
  Esmaeil Rahimian - [www.securehost.co] - Rahimian(at)SecureHost(dot)co