CVE-2008-6540
DotNetNuke < 4.8.2 - Unauthenticated Access Restriction Bypass via Default Validation and Decryption Keys
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6540. PoCs published by Brian Holyfield.
AI-analyzed exploit summary This exploit demonstrates a weak encryption vulnerability in DotNetNuke by generating and encrypting two FormsAuthenticationTickets to bypass authentication. The PoC shows how an attacker can craft malicious cookies to gain administrative access.
Description
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Exploits (1)
This exploit demonstrates a weak encryption vulnerability in DotNetNuke by generating and encrypting two FormsAuthenticationTickets to bypass authentication. The PoC shows how an attacker can craft malicious cookies to gain administrative access.