PT-2025-12060 · Phpipam · Phpipam

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10723

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpipam/phpipam version 1.5.2

Description A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam. This issue allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites.

Recommendations For version 1.5.2, update to version 1.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the NAT tool to minimize the risk of exploitation. Avoid using the destination address field in the NAT tool until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10723

Affected Products

Phpipam

References · 5

• 🔥 https://huntr.com/bounties/9af99057-e4f6-4d07-b3bb-3213b977801d · Exploit
• https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731 · Patch
• https://osv.dev/vulnerability/CVE-2024-10723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10723 · Security Note
• https://twitter.com/CVEnew/status/1902968907692212498 · Twitter Post