mailing list archives
XSS in Kaseya version 18.104.22.168 web interface
From: bede () foofus net
Date: Fri, 20 Apr 2012 08:57:09 -0700
The Kaseya version 22.214.171.124 web interface (and possibly other versions) is
vulnerable to Cross-Site Scripting in the "adminName" variable.
By submitting malicious input such as the following, it is possible to
3. Proof of Concept
Use a HTML proxy such as WebScarab or Burp to intercept the HTML form post
as it is submitted, and replace the "adminName" with the input above.
Kaseya web server.
5. Affected Products
"System Version 126.96.36.199" (from information pane of affected web server)
and possibly others.
Upgrade to the latest version. According to Kaseya, "The fix was actually
deployed with hotfix #1686, Files Released to VSAUpdate, batch 499 on
1/30/2012 6:16:06 PM"
2011-11-11 Advisory Written. Vendor notified via web form and e-mail.
2012-01-31 Vendor acknowledges flaw.
2012-02-27 Vendor notifies of available fix.
2012-03-01 Attempt to coordinate release of information with vendor
(to be determined)
bede () foofus net (Mark Lachniet)
- XSS in Kaseya version 188.8.131.52 web interface bede (Apr 20)