ESET Remote Administrator HTML Injection Vulnerability

Bugtraq ID:	33633
Class:	Input Validation Error
CVE:	CVE-2009-0548
Remote:	Yes
Local:	No
Published:	Feb 05 2009 12:00AM
Updated:	Feb 23 2009 02:07PM
Credit:	Nenad Vijatov and Ivan Markovic
Vulnerable:	Eset ESET Remote Administrator 3.0.35
Not Vulnerable:	Eset ESET Remote Administrator 3.0.105

ESET Remote Administrator HTML Injection Vulnerability

ESET Remote Administrator is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to ESET Remote Administrator 3.0.105 are affected.

ESET Remote Administrator HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

ESET Remote Administrator HTML Injection Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

ESET Remote Administrator HTML Injection Vulnerability

References:

• ESET Remote Administrator Changelog (ESET)
  
• ESET Remote Administrator Homepage (ESET)