Kaseya 6.2.0.0 Cross Site Scripting

`1. Summary  
  
The Kaseya version 6.2.0.0 web interface (and possibly other versions) is  
vulnerable to Cross-Site Scripting in the "adminName" variable.  
  
2. Description  
  
By submitting malicious input such as the following, it is possible to  
render javascript in the security context of the Kaseya server:  
  
"><sCrIpT>alert(83212)</sCrIpT>  
  
3. Proof of Concept  
  
Use a HTML proxy such as WebScarab or Burp to intercept the HTML form post  
as it is submitted, and replace the "adminName" with the input above.  
  
4. Impact  
  
Arbitrary JavaScript code may be executed in the security context of the  
Kaseya web server.  
  
5. Affected Products  
  
"System Version 6.2.0.0" (from information pane of affected web server)  
and possibly others.  
  
  
6. Solution  
  
Upgrade to the latest version. According to Kaseya, "The fix was actually  
deployed with hotfix #1686, Files Released to VSAUpdate, batch 499 on  
1/30/2012 6:16:06 PM"  
  
  
7. Timetable  
  
2011-11-11 Advisory Written. Vendor notified via web form and e-mail.  
2012-01-31 Vendor acknowledges flaw.  
2012-02-27 Vendor notifies of available fix.  
2012-03-01 Attempt to coordinate release of information with vendor  
2012-04-20 Published  
  
8. Reference  
  
(to be determined)  
  
9. Credits  
  
[email protected] (Mark Lachniet)  
  
  
  
`