Description

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-24T19:16:38.647Z",
  "pubdate": "2026-08-24T19:16:38.647Z",
  "executiveSummary": "Combodo iTop prior to version 3.2.3 is vulnerable to a PHP object injection vulnerability residing within the user preference functionality. This critical security flaw allows malicious actors to achieve remote code execution on the underlying host operating system. The vulnerability directly affects the Combodo iTop IT service management platform, posing severe risk implications including complete system compromise, data exfiltration, and unauthorized administrative access. Exploitation of this flaw requires an attacker to interact with the application logic governing user preferences, supplying crafted serialized payloads that the application unserializes unsafely. Given the high severity of remote code execution, organizations utilizing affected versions of Combodo iTop face immediate operational and security risks until remediation is applied.",
  "technicalDetails": "The vulnerability exists within the user preference functionality of Combodo iTop prior to version 3.2.3, specifically stemming from insecure deserialization of PHP objects. The root cause is the handling of user-supplied data within preference storage or retrieval mechanisms without proper input sanitization or validation before passing the data to the PHP unserialize() function.\nAttack flow begins when an authenticated or otherwise capable adversary interacts with the user preference endpoints or features within Combodo iTop. The attacker crafts a malicious serialized PHP payload containing specially constructed gadget chains designed to trigger arbitrary code execution upon instantiation or destruction within the application context. By injecting this payload into the vulnerable user preference parameters, the attacker forces the application to deserialize the malicious object.\nAs the PHP interpreter processes the unserialization of the crafted payload, magic methods such as __wakeup() or __destruct() within existing application or library classes (gadget chains) are automatically invoked. This execution flow allows the attacker to leverage existing codebase classes to manipulate system states, instantiate dangerous objects, or directly execute system commands on the server hosting Combodo iTop.\nThe vulnerability affects network-exposed instances of Combodo iTop across versions prior to 3.2.3. Depending on the precise accessibility of the user preference component, exploitation may require user authentication and low-level privileges within the application. The post-exploitation impact includes full remote code execution under the privileges of the web server process, enabling attackers to pivot deeper into the internal network, modify IT service management data, or establish persistent backdoors."
}