My DNN 7.3.2 site got hacked, through some form of vulnerability.

I learn about the problem from a notification sent from Google.  Otherwise, I probably will never find out the problem.

The hacker managed to inject content to the database and generated the following URL

http://embedded101.com/nbs.asp?datew3...

which redirect visitor to the following site:

http://www.viviofficialshop.com/

Is this a known security problem?

How do I go about fixing this?

Any help is much appreciated!

Sam

Thanks Sebastian!

Just deleted those 2 files.

From searching the web, I found information that lead me to believe it's a cross-site scripting attack.

According to the information on following URL, DNN prior to 7.4.0 is vulnerable to cross-site scripting (XSS) attack:

http://www.cvedetails.com/cve/CVE-201...

---------------------------------------------------------------------------------------------------------------

How do I remove the content injected to the database by the hacker?

 

@Cathal

Searching online, I found the following link (a site with collection of known security vulnerability) which indicates DNN prior to version 7.4.0 is vulnerable to cross-site scripting, where Authentication is not required to exploit the vulnerability.
http://www.cvedetails.com/cve/CVE-201...
Here is how the vulnerability is phrased on the above link:

"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors"

The Embedded101.com site has been using DNN since 2008.
Through all these years, I hardly have problem with the site being down unexpectedly.

Around the time I got the first notice from Google about the hack on June 9, the Embedded101.com site were down unexpectedly a number of times over a 2 weeks period, and has been stable for the past 2 weeks (Other than restarting the site to get it back up, I did not perform any update or administrative tasks)... This lead me to believe the site went down due to the attack.

So far, it's not a large scale attack to the site (I think, which I may be wrong... judging from the hacked message from Google I received).
I suspect the Embedded101 site is one of the target site the hacker used to test the XSS vulnerability.

Can you provide some guidance to clean out these entries?


Thanks!
Sam