Published: March 19, 2008
Version: 1.0
Maximum Severity Rating: Critical
Background
Since DotNetNuke 3.0 there has been a Skin Management option in the Admin interface. The Skin Manager is primarily used to apply a new skin to a site; however, it can also be used by designers for development of new skins using the Parse capability.
Issue Summary
A problem was identified where an Administrator could upload static files which could then be converted into dynamic scripts. This would allow server-side execution of application logic.
Mitigating factors
- The host user must have added the HTM or HTML file type to the default File Upload Extensions
- The user must have access to the file manager.
- By default this issue only affects Admin users.
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.8.2 at time of writing)
Acknowledgments
Timo Breumelhof
Security Policy
Click here to read more details on the DotNetnuke Security Policy