CyberRota Analysis
AI-GeneratedphpIPAM versions up to 1.8.1 are vulnerable due to inadequate validation of IP addresses against authorized subnets, allowing unauthenticated users with a valid temporary share URL to access sensitive information across all subnets. This vulnerability enables attackers to enumerate subnet IDs and retrieve detailed records, including hostnames, DNS names, and potentially sensitive configuration data. Organizations using phpIPAM should prioritize addressing this issue to prevent unauthorized data exposure and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).