Heatmiser Netmonitor 3.03 Web Interface outputSetup.htm outputtitle cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in Heatmiser Netmonitor 3.03. The impacted element is an unknown function of the file outputSetup.htm of the component Web Interface. The manipulation of the argument outputtitle results in cross site scripting. This vulnerability was named CVE-2019-25323. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Heatmiser Netmonitor 3.03. It has been classified as problematic. Affected is some unknown functionality of the file outputSetup.htm of the component Web Interface. The manipulation of the argument outputtitle with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and potentially manipulate the web interface's displayed content.

The weakness was presented by Ismail Tasdelen as 47828. The advisory is available at exploit-db.com. This vulnerability is traded as CVE-2019-25323 since 02/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:outputSetup.htm it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47828). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Heatmiser

Name

• Netmonitor

Version

• 3.03

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion