EIP-2026-108022

This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in iTop that allows remote code execution by injecting malicious PHP code into the configuration file. The PoC includes a form that, when submitted by an authenticated administrator, injects a PHP payload enabling arbitrary command execution via a GET parameter.