Phpipam CVE-2023-1211

HIGH

SQL Injection (CWE-89)

2023-03-07 security@huntr.dev

7.2

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Mar 07, 2023 - 00:15 nvd

HIGH 7.2

DescriptionNVD

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

AnalysisAI

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2. Affected products include: Phpipam.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Phpipam

View all

CVE-2022-41443 CRITICAL Act Now POC

phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.ph

CVE-2019-16696 CRITICAL Act Now POC

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used. Rated

CVE-2019-16695 CRITICAL Act Now POC

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. Rat

CVE-2019-16694 CRITICAL Act Now POC

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used

CVE-2019-16693 CRITICAL Act Now POC

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. Rate

CVE-2019-16692 CRITICAL Act Now POC

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is us

CVE-2018-1000869 CRITICAL Act Now POC

phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injec

CVE-2020-7988 HIGH This Week POC

An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. Rated high severity (CVSS 8.8), this vulnerabili

CVE-2024-10718 HIGH This Week POC

In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. Rated high se

CVE-2023-41580 HIGH This Week POC

Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-sear

CVE-2024-41354 HIGH This Week POC

phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php. Rated high severity (CVSS 7.1),

CVE-2024-41353 HIGH This Week POC

phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php. Rated high severity (CVSS 7

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2015-7297 HIGH POC

Same technique SQLi

View all

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2013-0333 HIGH POC

CVE-2015-7297 HIGH POC

Share

CVE-2023-1211 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy