While I have been using DNN since 4.x, I am not a DNN developer and not knowledgeable about DNN's system and data structure.

Can someone point me to the DNN SQL database table where the hacker likely to inject content to generate the following URL, which redirect user to another site?
http://embedded101.com/nbs.asp?datew3...

Should I search the database to look for entry for: "nbs.asp?datew3vnbfrp-37597.html"

Any help is much appreciated!
Sam

 Hello,

first off I wouldn't be worried about the CVE listing - that reflects the list of issues we have resolved and fixed (a number of vulnerability databases such as CVS, securityfocus etc add entries to their database based on http://www.dnnsoftware.com/platform/m... )

Secondly when I look again the problem is not DNN - you have a page called nbs.asp that does the redirect (ie it's a physical page and not a database entry). DNN uses aspx pages, that is a classic asp page. It appears someone has uploaded an asp page to your site -how this was done is difficult to predict. Often asp/php pages are uploaded to sites as part of a server level exploit i.e. a windows IIS server is not correctly patched (or has an old version of a product such as plesk or a mail server that is not patched), and when this is exploited asp/php pages are uploaded to every website on the server. If this is your server I recommend you check other sites, if not please raise it with your host. Note: I highly recommend disabling classic asp if you are not using it.

Note: I recommend you download and install http://www.dnnsoftware.com/forge/dnn-... and use it to check if you have any unexpected host users or poorly configured settings.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US