PT-2025-12059 · Phpipam · Phpipam

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-10722

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpipam/phpipam version 1.5.2 phpipam/phpipam versions prior to 1.7.0

Description A stored cross-site scripting (XSS) issue exists, allowing attackers to inject malicious scripts into the Description field of custom fields in the "IP RELATED MANAGEMENT" section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks.

Recommendations For version 1.5.2, update to version 1.7.0 to resolve the issue. For versions prior to 1.7.0, update to version 1.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the "IP RELATED MANAGEMENT" section until a patch is available. Avoid using the Description field in the custom fields of the "IP RELATED MANAGEMENT" section until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10722

Affected Products

Phpipam

References · 6

• 🔥 https://huntr.com/bounties/f0bc97b2-33a9-4b15-aa05-ff7c57624847 · Exploit
• https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10722 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10722 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671110770208903 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1902682853130850781 · Twitter Post