DNN Reflected Cross-Site Scripting Vulnerability in Module Actions

A reflected cross-site scripting vulnerability has been identified in DNN (DotNetNuke) versions prior to 9.13.9. This issue allows for the injection of an XSS payload through a specially crafted URL, which is then triggered by certain module actions. The vulnerability arises from insufficient validation of user input in module action links, enabling the execution of malicious scripts in the context of the user's session.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's session.

Reproduction

To reproduce this vulnerability, create a URL that includes an XSS payload and use it in a module action that does not properly sanitize input. When the action is triggered, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can update to DNN version 9.13.9 or later to address this vulnerability.