Heatmiser Netmonitor HTML Injection Vulnerability

A HTML injection vulnerability has been identified in Heatmiser Netmonitor version 3.03. The issue resides in the outputSetup.htm page, where the outputtitle parameter can be exploited to inject malicious HTML. By sending specially crafted POST requests that include harmful HTML code in the outputtitle parameter, attackers can manipulate the content displayed on the web interface.

Impact

Exploitation of this vulnerability allows for HTML injection, which could be used to execute scripts or manipulate the web interface's content.

Reproduction

To reproduce this vulnerability, send a POST request to the outputSetup.htm page with the outputtitle parameter containing the injected HTML. The injected HTML will be executed and can alter the content displayed on the web interface.