Executive brief
phpIPAM, an open-source IP address management application, contains a security flaw in its Request IP form. An attacker can inject malicious scripts into the instructions field, which are then executed when a legitimate user interacts with the page. This could lead to the theft of sensitive information, such as user credentials or session tokens, potentially compromising the management of the organization's network infrastructure.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in phpIPAM versions up to and including 1.7.3. The flaw is located in the /app/admin/instructions/edit-result.php endpoint, where the 'instructions' parameter fails to properly neutralize user-supplied input. An authenticated attacker can submit a crafted POST request containing malicious HTML or JavaScript (such as javascript: pseudo-protocol tags within form buttons). When a victim navigates to the Request IP page and interacts with the injected element, the script executes in the context of the victim's session. This can be used to exfiltrate sensitive data like usernames and passwords. The issue is addressed in version 1.7.4 and the v1.8 branch.
Affected products
- phpIPAM phpIPAM 1.7.3 and earlier
Timeline
- 2025-09-02: disclosed: Vendor notified
- 2025-11-17: patched: Fix committed to v1.7 and v1.8 branches
- 2025-11-27: patched: Version 1.7.4 released
- 2025-12-05: advisory: Public disclosure by researcher
- 2025-12-09: advisory: NVD published date