CVE-2022-23046

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

25.24% chance of exploitation in the next 30 days, 98th percentile

Published

2022-01-19

Updated

2024-08-03

Proof-of-concept exploits (5)

• http://packetstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.html
• https://fluidattacks.com/advisories/mercury/
• bernauers/CVE-2022-230461★ · 2022-05-23
• dnr6419/CVE-2022-230464★ · 2022-02-15
• jcarabantes/CVE-2022-230461★ · 2022-01-24

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50684

References

• CVE Record
• NVD entry

Related

• CVE-2018-16167
• CVE-2018-6905
• CVE-2019-7609
• CVE-2021-24145
• CVE-2021-24545
• CVE-2021-25646