Cross-site scripting in iTop - CVE-2011-4275
Published: November 26, 2011 / Updated: May 4, 2022
Vulnerability details
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 when processing (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
How to mitigate CVE-2011-4275
Links to Public Exploits and PoC-codes
- Exploit #4334 - Open Flash Chart 2 - Arbitrary File Upload (Metasploit) (August 11, 2020)
- Exploit #4337 - OpenEMR - Arbitrary .PHP File Upload (Metasploit) (August 11, 2020)
- Exploit #4315 - Piwik Open Flash Chart - Remote Code Execution (August 11, 2020)
- Exploit #4232 - OpenEMR 4.1.1 - 'ofc_upload_image.php' Arbitrary File Upload (August 11, 2020)
- Exploit #4227 - Joomla! Component com_civicrm 4.2.2 - Remote Code Injection (August 11, 2020)
- Exploit #4221 - ZonPHP 2.25 - Remote Code Execution (Remote Code Execution) (August 11, 2020)