cve/cves/2017/CVE-2017-9822.md

CVE-2017-9822

Description

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

POC

Reference

• http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
• http://www.dnnsoftware.com/community/security/security-center

Github

• https://github.com/murataydemir/CVE-2017-9822
• https://github.com/svdwi/OSWE-Labs-Poc
• https://github.com/pwntester/ysoserial.net

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9822.yaml

ExploitDB

• https://www.exploit-db.com/exploits/48336

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb