No CSRF mitigation techniques are used to protect the NetMon Viewer submit routine script at 'client/submit'. Thus, if a logged-in user navigates to an attacker-controlled site, the attacker can forge requests with the user's session.
Combined with , this vulnerability allows to compromise of the NetMon host by tricking a user with a logged-in NetMon Viewer session into clicking a malicious link or even by inserting images into user-frequented websites.
Insert the following HTML into a website that is visited by the victim:
<img href="http://monitoring.sittingduck.bv/client/submit">
Update NetMon to the latest version, in which the vulnerability has been fixed.