CVE-2023-44396 (PHP, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
application/utils.inc.php
pages/ajax.render.php
Commit message: N°6606 security hardening


Vulnerable code:
			$iRow = utils::ReadParam("iRow");
			$iCol = utils::ReadParam("iCol");
			$sDashletIdOrig = utils::ReadParam("dashletid");
			$sDashletClass = utils::ReadParam('dashlet_class', '');
			$sDashletId = utils::ReadParam('dashlet_id', '', false, 'raw_data');
			$aExtraParams = utils::ReadParam('extra_params', array(), false, 'raw_data');
			$aParams = utils::ReadParam('params', '', false, 'raw_data');
			$sDashletClass = $aParams['attr_dashlet_class'];
			$sDashletType = $aParams['attr_dashlet_type'];
			$sDashletId = utils::HtmlEntities($aParams['attr_dashlet_id']);
			$aUpdatedProperties = $aParams['updated']; // Code of the changed properties as an array: 'attr_xxx', 'attr_xxy', etc...
			$aPreviousValues = $aParams['previous_values']; // hash array: 'attr_xxx' => 'old_value'

Fixed code:
	 * Datamodel class
	 * @since 2.7.10 3.0.4 3.1.1 3.2.0 N°6606 update PHPDoc
	 * @uses MetaModel::IsValidClass()
	/**
	 * @var string
	 * @since 2.7.10 3.0.4 3.1.1 3.2.0 N°6606
	 * @uses class_exists()
	 */
	public const ENUM_SANITIZATION_FILTER_PHP_CLASS = 'php_class';
	 * @since 2.7.10 N°6606 new case for ENUM_SANITIZATION_FILTER_PHP_CLASS
			case static::ENUM_SANITIZATION_FILTER_PHP_CLASS:
				$retValue = $value;
				if (!class_exists($value)) {
					$retValue = false;
				}
				break;

			$iRow = utils::ReadParam("iRow", 0, false, utils::ENUM_SANITIZATION_FILTER_INTEGER);
			$iCol = utils::ReadParam("iCol", 0, false, utils::ENUM_SANITIZATION_FILTER_INTEGER);
			$sDashletIdOrig = utils::ReadParam("dashletid", '', false, utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
			$sDashletClass = utils::ReadParam('dashlet_class', '', false, utils::ENUM_SANITIZATION_FILTER_PHP_CLASS);
			$sDashletId = utils::ReadParam('dashlet_id', '', false, utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
			$aExtraParams = utils::ReadParam('extra_params', array(), false, utils::ENUM_SANITIZATION_FILTER_RAW_DATA);
			$aParams = utils::ReadParam('params', [], false, utils::ENUM_SANITIZATION_FILTER_RAW_DATA); // raw_data because we need different filter depending on the options
			$sDashletClass = utils::Sanitize($aParams['attr_dashlet_class'], DashletUnknown::class, utils::ENUM_SANITIZATION_FILTER_PHP_CLASS); // Dashlet PHP class or DashletUnknown if impl isn't present in the installed extensions
			$sDashletType = utils::Sanitize($aParams['attr_dashlet_type'], '', utils::ENUM_SANITIZATION_FILTER_PHP_CLASS); // original Dashlet PHP class, could be non-existing on the iTop instance (XML definition loading)
			$sDashletId = utils::Sanitize($aParams['attr_dashlet_id'], '', utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
			$aUpdatedProperties = utils::Sanitize($aParams['updated'], [], utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER); // Code of the changed properties as an array: 'attr_xxx', 'attr_xxy' etc
			$aPreviousValues = utils::Sanitize($aParams['previous_values'], [], utils::ENUM_SANITIZATION_FILTER_RAW_DATA); // hash array: 'attr_xxx' => 'old_value' - no sanitization as values will be handled in the Dashlet object