Published: March 19, 2008

Version: 1.0

Maximum Severity Rating: Critical

Background

Since DotNetNuke 3.0 there has been a Skin Management option in the Admin interface. The Skin Manager is primarily used to apply a new skin to a site; however, it can also be used by designers for development of new skins using the Parse capability.

Issue Summary

A problem was identified where an Administrator could upload static files which could then be converted into dynamic scripts. This would allow server-side execution of application logic.

Mitigating factors

• The host user must have added the HTM or HTML file type to the default File Upload Extensions
• The user must have access to the file manager.
• By default this issue only affects Admin users.

Affected DotNetNuke versions

• All versions since 3.0.

Non-Affected Versions:

• All other versions

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.8.2 at time of writing)

Acknowledgments

Timo Breumelhof

Security Policy

Click here to read more details on the DotNetnuke Security Policy