Hi Guys

 Apologies if this issue has been discussed before. I could not find a thread on this subject despite searching.

I have encountered a problem recently on one of my websites where a normnal registred user with no admin rights was able to edit a HTML module and insert some dodgy html code ( links to various sites ). The inserted HTML code in itself was not malicious and was hidden but was put in to be found by search engines so that they can get back links.

The editing of this module has been logged in DNN audit trail and it shows which user did this. I have checked the user in the admin panel and the user has no special permissions or rights. I have created a similar user to this with similar groups and permissions and tried to edit a HTML module using various techniques but I find that it is not possible. DNN always throws a security message.

But somehow this user has managed to do it.

Has anybody got any ideas on how this could have happened ? Also, the registration of the user and editing of the module happened one after the other indicating that the user who did this knew about this exploit and had done it before. He was clever enough to put the malicious entry into the footer of the web page.

Cheers

Vijay