CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 允许已验证的管理员用户在通过 app/admin/routing/edit-bgp-mapping-search.php 搜索子网时，向 "subnet" 参数注入 SQL 语句。 安装 1. 构建 git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 && docker-compose up -d pip3or pip install -r requirements.txt python3or python...

CVE-2022-23046

CVE-2022-23046 原始发现和手动PoC来自Fluidattacks: PhpIPAM v1.4.4 允许经过身份验证的管理员用户在通过 app/admin/routing/edit-bgp-mapping-search.php 搜索子网时，在“subnet”参数中注入 SQL 语句。 此PoC执行一些简单的SQL注入以获取如下信息： 基础服务器信息 SMTP设置 其他身份验证方法（如AD/LDAP/Radius） PHPIpam用户和哈希 MySQL数据库用户 其他可用模式...

Exploit for SQL Injection in Phpipam

CVE-2022-23046 The original discovery and manual PoC is from...

Code injection

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php...

CVE-2022-23046

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php...

phpIPAM SQL注入漏洞

phpIPAM is an open source PHP and MySQL based IP address management application IPAM. A SQL injection vulnerability exists in PhpIPAM v1.4.4, which originates from an authenticated administrator user being able to insert SQL statements in the subnet parameter when searching for subnets via...

CVE-2022-23046: Improper Neutralization of Special Elements used in an SQL Command

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php...