Recover from DNN - SQL Injection attack

Many attackers attack DNN website and able to get into module definitions to update the values so when ever somebody opens the website, you start getting so many annoying popups. In worst cases website could go offline also.

During the investigation you will see errors like

 DotNetNuke.Services.Exceptions.ModuleLoadException: String was not recognized as a valid Boolean. ---> System.FormatException: String was not recognized as a valid Boolean. at System.Boolean.Parse(String value) at DotNetNuke.Modules.Admin.Modules.ModuleSettingsPage.BindData() in 

You need to get into your database to clean up these values. There are 2 tables where you need to take a look, See the table names below

• dbo.ModuleSettings 
• dbo.TabModuleSettings 

Inside these tables, Check the SettingValue which might be affected. Take a backup of these tables, and use the following script to clean up these tables 

See the entries

SELECT [TabModuleID]
      ,[SettingName]
      ,[SettingValue] as SettingValue_Old,
       left(SettingValue, charindex('

Update [dbo].[TabModuleSettings]
set SettingValue = left(SettingValue, charindex('