Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-21T21:16:57.250Z",
  "pubdate": "2026-08-21T21:16:57.250Z",
  "executiveSummary": "An input validation and output encoding vulnerability exists within the Combodo iTop IT service management platform, specifically manifesting as a Reflected Cross-Site Scripting (XSS) security flaw.\nThis vulnerability affects versions prior to 3.2.3 and allows remote, unauthenticated or authenticated attackers to inject malicious client-side scripts, typically JavaScript, into the application via HTTP request parameters.\nThe primary impact of successful exploitation includes the execution of arbitrary script code in the context of the victim's browser session, potentially leading to session hijacking, credential theft, sensitive data exposure, and unauthorized actions performed on behalf of the user.\nThe risk implication is significant for organizations utilizing vulnerable deployments of Combodo iTop, as malicious payloads can be weaponized and delivered via crafted URLs to targeted users.\nAttacker capabilities are constrained by the necessity of social engineering or user interaction, requiring a victim to click a specially crafted malicious link containing the payload.\nThe vulnerability has been officially addressed and resolved by the vendor in version 3.2.3 through proper sanitization and context-aware output encoding measures.",
  "technicalDetails": "The vulnerability resides in the application logic handling HTTP requests processed by the vulnerable component located at pages/tagadmin.php within the Combodo iTop codebase.\nThe root cause of the Reflected Cross-Site Scripting (XSS) vulnerability is the lack of rigorous input sanitization and the absence of proper context-aware output encoding of user-supplied data before it is reflected back to the client within the Hypertext Markup Language (HTML) response.\nNetwork exposure is inherent to any web-based deployment of Combodo iTop accessible via standard HTTP or HTTPS protocols.\nThe attack flow commences when an adversary crafts a malicious Uniform Resource Locator (URL) targeting pages/tagadmin.php, embedding an arbitrary script payload (such as <script>alert(document.cookie)</script>) within vulnerable HTTP GET or POST parameters processed by the script.\nThe attacker then induces a legitimate authenticated user of Combodo iTop to interact with the crafted URL through phishing, external links, or other social engineering vectors.\nUpon receiving the request, the server-side script at pages/tagadmin.php processes the input parameters and dynamically generates an HTTP response containing the unescaped, malicious payload.\nThe victim's web browser receives the response and parses the injected payload as legitimate application code or markup, executing the script within the security context of the victim's active session.\nBecause the script executes within the browser session of the affected user, the payload behavior can include unauthorized interactions with the Document Object Model (DOM), access to session cookies, extraction of sensitive application data, and execution of asynchronous requests (XMLHttpRequest or Fetch) acting as the authenticated user.\nThe affected versions include all instances of Combodo iTop prior to version 3.2.3."
}