CVE-2020-37103
MEDIUMDotNetNuke < 9.5.0 - Persistent Cross-Site Scripting via Journal XML File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37103. PoCs published by Sajjad Pourali.
AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in DotNetNuke 9.5 by uploading a malicious XML file containing XHTML script tags. The PoC shows how an attacker can execute arbitrary JavaScript in the context of a user's browser session.
Description
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
Exploits (1)
This exploit demonstrates a persistent XSS vulnerability in DotNetNuke 9.5 by uploading a malicious XML file containing XHTML script tags. The PoC shows how an attacker can execute arbitrary JavaScript in the context of a user's browser session.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N