DNN Prompt Module Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the DNN (DotNetNuke) Prompt module, prior to version 10.1.0. The issue arises because the Prompt module can execute commands that return raw HTML. Malicious input, even if sanitized for other displays, can be executed through certain commands, potentially leading to script execution. This vulnerability is particularly concerning in the context of a super-user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to DNN version 10.1.0 or later to address this vulnerability.