I just downloaded DNN and I am trying to get a better understanding of it.

Doesn't the Internet Guest Account need to be given write permissions to the folder in order for the upload to work?

Wouldn't the folder being used then be opened for attack? Couldn't someone scan the server, see that the account has write access to that folder and drop files there, then either run malicious software, or use it as a place to put illegal copies of movies, music, etc.?

I work at a university and one of the areas in my office wants to move their current blogs from an outside vendor's site to ours. They also want  to eventually add an Wiki. So DNN looked to me to be the best solution. At the most there will be 15 bloggers who on average blog about 3 times a week. So we're not looking at a really high volume of entries here. Not ever entry will include images.

I had trouble getting the system admin to give the account write access on my test server, so I know it will be a battle to do it on my production server. That is why I want to upload the files to the SQL server.  

How big of a security issue is that for the server?

Could someone without access to the upload pages of the DNN get into the folder and drop files?

Thank you for the information!

I will let my system admin know this.

It will make implementing DNN a lot easier if I don' t have to modify modules!