PT-2025-12057 · Phpipam · Phpipam

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-10720

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpipam/phpipam version 1.5.2 phpipam/phpipam versions prior to 1.7.0

Description A stored cross-site scripting (XSS) issue exists in the 'Device Management' section under 'Administration', where an attacker can inject malicious scripts into the Name and Description fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks.

Recommendations For version 1.5.2, update to version 1.7.0 to resolve the issue. For versions prior to 1.7.0, update to version 1.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the 'Device Management' section under 'Administration' to minimize the risk of exploitation. Avoid using the Name and Description fields in the 'Device Management' section until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10720

Affected Products

Phpipam

References · 6

• 🔥 https://huntr.com/bounties/75e06e05-7f69-4938-a83c-1dcc98922188 · Exploit
• https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731 · Patch
• https://osv.dev/vulnerability/CVE-2024-10720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10720 · Security Note
• https://twitter.com/WolfgangSesin/status/1902682853890203692 · Twitter Post
• https://twitter.com/CVEnew/status/1902671103161684372 · Twitter Post