Itop - SQLi (CVE-2024-32870)
98Exploiting IPs reported
Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CrowdSec analysis
CVE-2024-32870 is a vulnerability in Combodo iTop that can lead to unauthorized disclosure of sensitive server and application information through a specific web endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 29th of April 2025.
CrowdSec network observations suggest that most exploitation of CVE-2024-32870 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2024-32870 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Exploitation attempts commonly target requests to URLs containing /pages/exec.php referencing the iTop Hub Connector functionality.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.