CVEs-PoC/2021/CVE-2021-41245.md

CVE-2021-41245

Description

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by privUITransactionFile aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.

POC

Reference

• https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/cyb3r-w0lf/nuclei-template-collection