GHSA-x8f7-h444-97w4

The installation wizard in DotNetNuke (DNN) allows privilege escalation

Source: GitHub Advisory Database (reviewed) Critical CVE-2015-2794

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	DotNetNuke.Core	< 7.4.1	7.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-2794 advisory
https://dotnetnuke.codeplex.com/releases/view/615317 web
https://github.com/advisories/GHSA-x8f7-h444-97w4 advisory
https://www.exploit-db.com/exploits/39777 web
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue web
http://www.dnnsoftware.com/community/security/security-center web
http://www.securityfocus.com/bid/96373 web