Unauthenticated Stacked SQL Injection in DNNGo.Modules.PowerForms via PhotoID Parameter

Summary

DNNGo.Modules.PowerForms version 9.2.1.0 is vulnerable to unauthenticated SQL injection via the PhotoID parameter in Resource_TempSaves.ashx. This vulnerability allows stacked queries, allowing an attacker to execute not only SELECT statements but also INSERT, UPDATE, and DELETE statements. This enables an unauthenticated attacker to create a malicious administrator account and take over the entire DNN instance, leading to remote code execution.

Affected versions

• DNNGo.Modules.PowerForms ≤ 9.2.1.0

Technical details

The vulnerability exists in the DeliverFile() function within DNNGo.Modules.PowerForms.dll, called via the unauthenticated handler Resource_TempSaves.ashx. The PhotoID query parameter is inserted directly into a SQL query without sanitisation or parameterisation.

Critically, the underlying SQL Server configuration permits stacked queries (statement batching via ;), which allows an attacker to append arbitrary SQL statements to the original query. This elevates the impact far beyond read-only data exfiltration.

Proof of concept

The following request demonstrates exploitation via a stacked UPDATE query. By manipulating the UserPortals table, an attacker can grant administrator privileges to any existing user:

GET /DesktopModules/DNNGo_PowerForms/Resource_TempSaves.ashx?PhotoID=0)%20x;%20UPDATE%20UserPortals%20SET%20Authorised=1%20WHERE%20UserID=123;-- HTTP/2

URL-decoded for readability:

PhotoID = 0) x; UPDATE UserPortals SET Authorised=1 WHERE UserID=123;--

The injected payload closes the original SQL expression, terminates the first statement, and appends a second UPDATE statement that sets the target user as authorised on the portal. The trailing -- comments out the remainder of the original query.

By combining this with INSERT statements, an attacker can register a new administrator account from scratch without any prior access to the application.

Impact

An unauthenticated attacker can achieve full takeover of the DNN instance:

• Create or promote arbitrary administrator accounts via INSERT/UPDATE on DNN user tables.
• Read, modify, or delete any data in the database via stacked queries.
• Exfiltrate credentials and password hashes from aspnet_Membership.
• Depending on SQL Server configuration and permissions, potentially execute OS-level commands via xp_cmdshell.

Remediation

The vendor has patched the vulnerability in the latest version. If you want to take additional measures, consider the following mitigations:

• Block or restrict access to /DesktopModules/DNNGo_PowerForms/Resource_TempSaves.ashx at the WAF or web server level.
• Ensure the SQL Server account used by DNN runs with least-privilege permissions to limit the blast radius of stacked query abuse.
• Disable xp_cmdshell on the SQL Server instance if not required.

Timeline

26 February 2026	Discovery
14 March 2026	Reported to vendor
15 March 2026	Acknowledged by vendor
23 April 2026	CVE ID requested
21 July 2026	CVE assigned
27 July 2026	Public disclosure

References

• DNNGo