DotNetNuke User-Agent String Application Logs HTML Injection Vulnerability

DotNetNuke is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Specifically user-supplied input supplied as a User-Agent string value is not sanitized, allowing script or HTML code to be included in application log files.


 

Privacy Statement
Copyright 2010, SecurityFocus