CVEs-PoC/2021/CVE-2021-41245.md

### [CVE-2021-41245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41245)
![](https://img.shields.io/static/v1?label=Product&message=iTop&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%202.7.6%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen)

### Description

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.

### POC

#### Reference
- https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae

#### Github
- https://github.com/20142995/nuclei-templates
- https://github.com/cyb3r-w0lf/nuclei-template-collection