I think it's more an exploitation of some of the unsafe modules that are popping up to support DNN. I remember something about this with NewBlog last year, and, IIRC, Hans-Peter promised to fix it.

This is not a knock on HP, per se, but it should be pointed out that NewBlog is still not "fixed". Lack of input sanitation in many of the modules will make wider adoption of DNN difficult, especially in light of this Microsoft defacement and the accompanying Zone-H report that specifically mentioned dotnetnuke.

Once the news spread, DNN will see more probes from the curious and the malicious. Unless we do something NOW, the end result will not be pleasant. As the "MS France Hacker" has shown, you don't need a lot of brain power to cause havocs, and you certainly need to programming skills to see that some DNN modules are sitting ducks.

BTW, I have no programming skills to brag about, but I have screen shots of unsanitized input XSS in a specific DNN module.