:)

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

So far it seems that DNN itself does not have an open access vector of the style used in the recent SQL injection attacks.  

Though there is not a lot of really strong information on the exact nature of the injection methods currently being utilized, but for the most part it would appear to be related to older versions of MS SQL and poorly written asp web applications based on out dated web methodologies.

One of the big issues with the internet, is that very few web sites are willing to keep stumping up money to ensure their sites are kept up to date.  There are millions of older asp based web sites out there for example, running on web servers that are over 10 years old.  Yes they may have been patched and kept up to date with service packs - BUT in many cases the actual methods used on these sites to accept data has itself not always been updated. 

One of the most common and effective way of mitigating SQL injection attacks is to ensure that all SQL queries in an application use parameterized access calls and  to ensure that any input fields are filtered for invalid sql escape type codes.
DNN falls into the first category by default given its use of a database provider model that does not allow direct access to the SQL calls themselves.
But having said this - this does not actually mean that ALL 3rd party modules would be safe - they could possibly become compromised if badly written. 

Westa