漏洞描述
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2015-2794↗www.dnnsoftware.comhttp://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue↗www.dnnsoftware.comhttp://www.dnnsoftware.com/community/security/security-center↗dotnetnuke.codeplex.comhttps://dotnetnuke.codeplex.com/releases/view/615317↗