CVE-2019-12562
MEDIUMDotNetNuke < 9.4.0 - Stored Cross-Site Scripting in Admin Notification Page
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-12562. PoCs published by MaYaSeVeN, MAYASEVEN.
AI-analyzed exploit summary This exploit leverages a stored XSS vulnerability in DotNetNuke (DNN) before version 9.4.0 to add a superuser account. It injects a malicious script into the Display Name field during registration, which executes when an admin views the notification page.
Description
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.
Exploits (2)
This exploit leverages a stored XSS vulnerability in DotNetNuke (DNN) before version 9.4.0 to add a superuser account. It injects a malicious script into the Display Name field during registration, which executes when an admin views the notification page.
This repository contains a functional exploit for CVE-2019-12562, a stored XSS vulnerability in DotNetNuke (DNN) before version 9.4.0. The exploit adds a superuser account by injecting malicious JavaScript into the Display Name field during registration, which executes when an admin views the notification page.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N