Something happened today that really pissed me off.

First of all, I was on the FTP uploading some new images to my portals/0 folder when I noticed a .txt file that had a silly name.

I downloaded it, virus scanned it and opened it to find a little spiel about Turkish Hackers and some other nonsense. Now I know this sort of thing is stupid and harmless but it really worried me that a more advanced hacker could exploit this even more.

I searched the term "Federal Atack Team" on google because I found 4 files in my portal/0 that had this labeling somewhere in the text... the next thing I know I have hundreds of results on google with the same .txt files and most of them were in company's website's portal/0 folders.

Now I'm not a security expert but I would assume these "hackers" found an exploit in a registration form or something of that sort and were able to SQL inject it with a .txt file.

Please get back to me with an explaination and a patch! And please google the above phrase and see that this effects almost everyone who uses DNN.

Thanks.

on top of the info Chris provided: please sure to review the DNN security policy and bulletins, located here: http://www.dotnetnuke.com/tabid/1246/Default.aspx

DNN Blog | Twitter: @erikvb | LinkedIn:

this just goes to show that there are many site owners that are running old dnn versions without knowing the risks. I guess thats not something we can solve, other than having some kind of auto update functionality. Prior to when microsoft came up with windows update, people didnt apply security patches either...

DNN Blog | Twitter: @erikvb | LinkedIn: