CVE-2018-10642

PoC —

CVSS 3.0

7.2 high

EPSS

7%p94

Published

May 2, 2018 (May 2, 2018)

Modified

Jun 17, 2026

Description

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().

Vendors: combodo
Products: itop
Weakness: CWE-94
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (7.4%)

In the news0 stories

No ingested article mentions this CVE yet.