Critical SQL Injection Flaw Discovered in phpIPAM 1.4 (CVE Pending)

Critical SQL Injection Vulnerability Identified in phpIPAM 1.4

Security researchers have disclosed a severe SQL injection (SQLi) vulnerability in phpIPAM 1.4, an open-source IP address management (IPAM) solution. The flaw, currently awaiting a CVE assignment, allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to full database compromise.

Technical Details

The vulnerability resides in phpIPAM 1.4’s codebase, specifically in how user-supplied input is processed without adequate sanitization. Attackers can exploit this flaw by crafting malicious HTTP requests containing SQL payloads. Successful exploitation could result in:

• Unauthorized access to sensitive database contents
• Data exfiltration (e.g., user credentials, network configurations)
• Database manipulation or deletion
• Potential remote code execution (RCE) in chained attacks

The exploit (EDB-ID: 52453) has been published on Exploit-DB, increasing the urgency for organizations to apply mitigations. No authentication is required to trigger the vulnerability, classifying it as a pre-authentication SQLi with a high severity rating.

Impact Analysis

phpIPAM is widely deployed in enterprise environments for IP address and subnet management. A successful attack could expose:

• Network infrastructure details (e.g., subnets, VLANs, device mappings)
• User credentials stored in the database (including hashed passwords)
• Sensitive operational data (e.g., DHCP/DNS configurations)

Given the public availability of the exploit code, security teams should assume active scanning and exploitation attempts are underway.

Recommendations

1. Immediate Actions:

   • Apply the vendor-supplied patch (if available) or upgrade to the latest version of phpIPAM.
   • If patching is not feasible, implement web application firewall (WAF) rules to block SQLi patterns targeting phpIPAM endpoints.

2. Monitoring:

   • Audit database logs for unusual query patterns or unauthorized access attempts.
   • Deploy intrusion detection/prevention systems (IDS/IPS) to detect exploitation attempts.

3. Long-Term Mitigations:

   • Review and harden database permissions, ensuring least-privilege access.
   • Conduct a security assessment of all web-facing applications to identify similar vulnerabilities.

Organizations using phpIPAM 1.4 are urged to prioritize remediation due to the flaw’s critical severity and public exploit availability. Further updates will be provided once a CVE ID is assigned.