Hmmm - I wish the owner of said component could confirm if this was the case - would be nice to know if this was the vulnerability affecting high-profile DNN sites.

Chris - could you perhaps confirm if this was or was not the case with your website here? Would allay some fears...

Thanks

---

Entrepreneur

PokerDIY Tournament Manager - PokerDIY Tournament Manager<
PokerDIY Game Finder - Mobile Apps powered by DNN
PokerDIY - Connecting Poker Players

then since it was blogged, posted, emailed...   why can you not mention it?

something...  as the risk is very high obviously.

 

I know what it is..  just not going to say so..

I have been watching this incident for a while now and it seems to be getting worse not better. Go to Zone-h.org and search  the defacement archives under "access violation". That is practically all that access violation has been hitting for the last two months (ever since nobody coder shared it would be my guess). I was completely new to DNN until this incident brought me here; A 3rd party client contacted me to find out how his server got defaced and I discovered the vulnerability. I was able to find quite a few vulnerable sites with a simple Google search (I did contact the site owners to make them aware of the situation). Unfortunatley this is not being used just for defacements, I have seen shell code and password stealing code on some of the sites I worked with and the sites were never defaced. This incident is being reported in the security community as an "unspecified" DotNetNuke Vulnerability, not the 3rd party module vulnerability which it is. So like it or not Cathal you are the focal point of this debate because the vunerability has been (incorrectly) associated with your product. You may want to consider sending an email clarifying the situation to places like zone-h.org, securitytracker.com, and qualsys.com to put some distance between the 3rd party publisher and DNN. The exact details of this vulnerability are already out, it just has not gotten very much attention yet.