PT-2025-49557 · Phpipam · Phpipam

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-60912

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions phpIPAM version 1.7.3

Description The software contains a Cross-Site Request Forgery (CSRF) issue in the database export functionality. The generate-mysql.php function, located at the /app/admin/import-export/ API endpoint, can be exploited to trigger large database dump downloads through specially crafted HTTP GET requests when an administrator is logged in. The vulnerability allows remote attackers to perform actions on behalf of an authenticated administrator.

Recommendations Apply updates to address the issue in the affected version. As a temporary workaround, consider restricting access to the /app/admin/import-export/ endpoint.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-60912

Affected Products

Phpipam

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-60912 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60912 · Vendor Advisory
• https://github.com/phpipam/phpipam · Note
• https://t.me/cveNotify/145142 · Telegram Post
• https://gist.github.com/amandrei/a8377d9b71c55156d22aaaf485463d15 · Note
• https://t.me/CVEtracker/39126 · Telegram Post
• https://twitter.com/CVEnew/status/1998049569783857300 · Twitter Post