Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Security breachSecurity breach
Previous
 
Next
New Post
4/16/2009 7:29 AM
 

FYI: i posted a little on something similar @ http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/1930/is-DotNetNuke-vulnerable-to-sql-injection.aspx . I've had a number of security reports that have turned out to be a poorly coded legacy application (typically an old asp application) on a server, allowing an automated attack to then add content to all the databases on a server - the scripts kindly provided by previous posters on this thread are the best way to check for this.

Cathal


Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
 
New Post
4/16/2009 10:21 AM
 

Sorry my post came in so late.  I'm still moderated, hopefully that will change soon :) .

One final follow up in case you want to see the explanation from the hosting company.

http://forums.networksolutions.com/general-web-hosting-questions-feedback-f44-very-big-concern-over-script-worm-being-injection-into-web-pages-t4124.html

Charles Self
Narrow Gate Solutions
www.narrowgatesolutions.com
dotnetnuke.narrowgatesolutions.com - DNN Related Resources

 

 
New Post
4/16/2009 10:36 AM
 

Mamlin:

Sorry, I did not mean to undermine your post, just wanted to provide another alternative.  It it just that I did not see the CREATE PROC in yours so I decided to post the full code I had.  I did not review the actual code logic, so they may actually work in the same way (or be exactly the same). 

Your suggestion to search for INTs is good, it is just that I never had to do that, or when I did, I pretty much knew what table to use.  What I did do as an exercise as well as to help in a project I was doing was to write a .Net console app to basically implement the same generalized full DB string search logic but that would work against any database you can access via ADO.Net.  Why you ask?  Because I had to work with a third party (commercial) application developed in MS-Access that had a very horrible design, i.e. not normalized at all, used company names for links between tables, etc.  I've been meaning to make this little app public but as usual, lack of time has prevented it.  I just want to clean up the code a little bit.

And to expand on something I read in one of the posts, regarding SQL Injection.  The little hack or "defacement" I actually experienced in my DNN 4.9.2 site was actually allowed by the DNN code, which is why it had to be fixed in 4.9.3.  Don't get me wrong, I don't want to put down the Core Team, but the reality is that the DNN code allowed something that it shouldn't have.  To be specific, it was allowing a user to enter text in any module that used the FCKEditor to enter code in the form <script>some malicious javascript</script>.  Is that SQL Injection, well, not exactly because it is not injecting SQL code, it is injecting Javascript code.  I do not know what would have happened if actual SQL code was attempted, probably wouldn't work because of the DAL/BLL architecture.  Should this be something the module developers should take care of in the module code in the first place?  I don't know, maybe.

Let me also expand on my site's defacement via Javascript.  All the hacker was able to do was to enter JS code in the Guestbook that when loaded back to the browser would load an animated picture of a skull and bones from another site.  I am not going to publish that code but it is very simple and I now use it for testing for this weakness on other sites.  It looked scary but was very easy to clean up and the attacker had no access to modify the database directly, was not able to load any files to the server, and had no access to any of the DNN, SQL, or Windows accounts.  I manage my own server and checked all these things carefully.  To summarize, DNN is a very secure platform, remember that the server must be setup and managed with best security practices in mind as usual.

Carlos

 

 
New Post
4/20/2009 1:10 PM
 

Chuck Self wrote

Sorry my post came in so late.  I'm still moderated, hopefully that will change soon :) .

One final follow up in case you want to see the explanation from the hosting company.

http://forums.networksolutions.com/general-web-hosting-questions-feedback-f44-very-big-concern-over-script-worm-being-injection-into-web-pages-t4124.html

Charles Self
Narrow Gate Solutions
www.narrowgatesolutions.com
dotnetnuke.narrowgatesolutions.com - DNN Related Resources

 

Well, I hate that it happened to you as well, but I'm glad to see someone else is sharing my pain. Same host, by the way.  I'm not sure if I am the one that alerted them to the problem or not - I submitted a support ticket, and 10 minutes later, our site was down.  Seems like they have patched the problem enough times that they actually have a system to go through - rather than simply finding a 'solution'.

 
New Post
4/20/2009 1:54 PM
 

I had another client get bit by a similar injection last week, this one is just downright nasty!


-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.
LinkedIn Profile

Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services
 
Previous
 
Next
HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Security breachSecurity breach


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out