Executive brief
iTop is a web-based IT service management platform used by organizations to track assets, incidents, and service requests. A reflected cross-site scripting (XSS) flaw in the data synchronization import feature allows an authenticated attacker to inject malicious scripts via a crafted URL, potentially stealing session tokens, modifying data, or compromising user accounts when victims click the malicious link.
Technical details
The vulnerability is a reflected XSS in the synchro_import.php script caused by improper sanitization of the data_source_id query parameter. The parameter was previously processed with 'raw_data' mode, allowing script injection; the fix sanitizes it as an integer value using utils::ENUM_SANITIZATION_FILTER_INTEGER. Attack requires network access to the iTop instance and low-level privileges (authentication) plus user interaction (victim clicking a malicious link). An attacker can execute arbitrary JavaScript in the victim's browser within the security context of the iTop application, potentially accessing sensitive IT infrastructure data. Patches are available in versions 3.2.3 and 3.3.0.
Affected products
- Combodo iTop prior to 3.2.3
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Fixed in versions 3.2.3 and 3.3.0