CVE-2025-48377: DNN CMS XSS Vulnerability in Module Actions

CVE-2025-48377 Overview

CVE-2025-48377 is a cross-site scripting (XSS) vulnerability in DNN Platform (formerly DotNetNuke), an open-source content management system (CMS) built on the Microsoft .NET stack. Attackers can craft a malicious URL that injects a script payload executed when a user triggers certain module actions. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). It affects DNN Platform versions prior to 9.13.9, which contains the fix.

Critical Impact
An authenticated attacker can deliver a crafted URL that executes arbitrary JavaScript in a victim's browser session, enabling session abuse and administrative action hijacking within the DNN application context.

Affected Products

DNN Platform (DotNetNuke) versions prior to 9.13.9
dnnsoftware/Dnn.Platform open-source distribution
DNN deployments exposing module action URLs to authenticated users

Discovery Timeline

2025-05-23 - CVE-2025-48377 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48377

Vulnerability Analysis

The vulnerability lives in how DNN Platform processes URL-derived values that are later rendered inside module action handlers. A specially crafted URL can carry an XSS payload that is reflected or stored by the module action pipeline. When another user interacts with the affected module action, the browser evaluates the injected script.

The security advisory GHSA-79m3-rvx2-3qq9 confirms the issue exists prior to version 9.13.9. Exploitation requires low-privileged authentication and user interaction with a module action to trigger payload execution.

Root Cause

The root cause is improper neutralization of user-controlled URL input before it is written into the HTML rendered by module action logic. The patched components, including ViewConsole.ascx.cs in the Console module, add HTML encoding by importing System.Web and applying encoding to untrusted values prior to output.

Attack Vector

The attack vector is network-based. An attacker with a low-privileged DNN account crafts a URL embedding a JavaScript payload. The attacker then lures an authenticated user, often an administrator, to interact with a module action referenced by that URL. Execution occurs in the victim's browser under the DNN origin, enabling theft of session cookies, forging of in-app requests, and manipulation of administrative controls.

csharp

// Patch excerpt: DNN Platform/Admin Modules/Dnn.Modules.Console/ViewConsole.ascx.cs
 using System.IO;
 using System.Linq;
 using System.Text;
+using System.Web;
 using System.Web.UI.WebControls;

 using Dnn.Modules.Console.Components;

Source: dnnsoftware/Dnn.Platform commit 351b166

The added System.Web import enables use of HttpUtility.HtmlEncode within the Console view code-behind so URL-derived values are encoded before being emitted to the response.

Detection Methods for CVE-2025-48377

Indicators of Compromise

Requests to DNN module action endpoints containing URL parameters with <script>, javascript:, event handler attributes (onerror=, onload=), or encoded variants.
Access log entries where authenticated low-privilege users generate crafted URLs that are then followed by administrator sessions.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting a DNN module page.

Detection Strategies

Inspect IIS and application logs for query strings and referrers that include encoded HTML or JavaScript tokens targeting DNN module action URLs.
Deploy a web application firewall (WAF) ruleset for reflected and stored XSS patterns on DNN endpoints, particularly those routing to module action handlers.
Monitor DNN administrator sessions for anomalous actions, including unexpected user creation, role changes, or module edits.

Monitoring Recommendations

Enable detailed request logging on DNN sites and forward logs to a centralized analytics platform for query-string and referrer inspection.
Alert on administrative actions that originate from browsers immediately after visiting module action URLs containing untrusted parameters.
Track the running version of DNN Platform across hosts and flag any instance below 9.13.9.

How to Mitigate CVE-2025-48377

Immediate Actions Required

Upgrade DNN Platform to version 9.13.9 or later, which contains the fix referenced in commit 351b166.
Audit DNN user accounts, especially low-privilege roles, and remove or disable accounts that are not required.
Review recent administrator activity for signs of session misuse following the vulnerability's disclosure window.

Patch Information

The fix is delivered in DNN Platform 9.13.9. The upstream change is published in commit 351b166 and detailed in GHSA-79m3-rvx2-3qq9. The patch introduces HTML encoding of URL-derived values within affected module code paths, including the Console module view.

Workarounds

Restrict registration and reduce the number of accounts with permissions to interact with vulnerable module actions until the patch is applied.
Place a WAF in front of the DNN site with rules that block script tokens and event-handler attributes in query strings targeting module endpoints.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts, reducing the impact of reflected XSS in the DNN origin.

bash

# Verify installed DNN Platform version against the fixed release (9.13.9)
grep -R "AssemblyFileVersion" /path/to/dnn/bin/ 2>/dev/null | head -n 5

# Example WAF rule (ModSecurity) blocking common XSS tokens on DNN module URLs
SecRule REQUEST_URI "@contains /DesktopModules/" \
  "chain,id:1004833,phase:2,deny,status:403,msg:'Potential XSS in DNN module action'"
  SecRule ARGS|REQUEST_URI "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni"