Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-21T20:16:34.313Z",
  "pubdate": "2026-08-21T20:16:34.313Z",
  "executiveSummary": "A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Combodo iTop prior to version 3.2.3. The vulnerability resides within the dashboard revert functionality, specifically via the dashboard_id parameter handled by the endpoint /pages/ajax.render.php. This security flaw allows remote attackers to inject malicious client-side scripts, typically JavaScript, into the application's response when improperly sanitized user input is reflected back to the user's browser. Successful exploitation of this vulnerability can lead to severe security implications, including the execution of arbitrary script code in the context of the victim's active session, session hijacking, credential theft, and unauthorized actions performed on behalf of the authenticated user. The risk is elevated by the web-based nature of the IT service management platform, which is typically accessible across network perimeters. Attackers require the capability to deliver a crafted URL containing the malicious payload to a target user and coerce them into interacting with it. The vulnerability has been officially remediated by the vendor in version 3.2.3 through proper input sanitization and output encoding mechanisms.",
  "technicalDetails": "The vulnerability is classified as a reflected Cross-Site Scripting (XSS) flaw affecting the dashboard revert functionality of Combodo iTop prior to version 3.2.3. The root cause of the issue stems from insufficient input validation and output encoding of user-supplied data submitted via the dashboard_id parameter. This parameter is processed by the backend script located at /pages/ajax.render.php.\nDuring a typical exploitation scenario, an attacker crafts a malicious Uniform Resource Locator (URL) targeting the vulnerable /pages/ajax.render.php endpoint. The crafted URL incorporates a payload containing executable JavaScript or HTML tags injected directly into the dashboard_id parameter value. The attacker then distributes this URL to an authenticated iTop user through social engineering vectors such as phishing emails or malicious links.\nWhen the victim clicks the crafted link, the victim's web browser sends an HTTP request to the Combodo iTop server containing the malicious payload within the dashboard_id parameter. The server-side script processes the input and unsafely reflects the unescaped parameter value back within the HTTP response body generated by /pages/ajax.render.php.\nUpon receiving the response, the victim's browser interprets the reflected input as active content rather than inert text data, executing the malicious script within the security context of the victim's active session. This enables the script to access Document Object Model (DOM) elements, read session cookies, transmit sensitive session tokens to attacker-controlled infrastructure, and perform unauthorized state-changing operations within the iTop application on behalf of the victim.\nThe affected component is the dashboard rendering subsystem handled by /pages/ajax.render.php in Combodo iTop versions prior to 3.2.3. Network exposure is inherent to the web application's accessibility. Exploitation requires network access to the iTop instance and user interaction, typically leveraging the victim's existing authentication state and privileges."
}