CVE-2022-23046
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via...
- Published
- Jan 19, 2022
- Updated
- Aug 3, 2024
- Assigning CNA
- Fluid Attacks
- Evidence observed
- Jan 25, 2022
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 97.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
Sources
- CVE-2022-23046Exploit
Tinker Script for CVE-2022-23046
- CVE-2022-23046Exploit
SQL Injection Vulnerability on PhpIPAM v1.4.4
- phpipam_1.4.4Exploit
Exploit script for CVE-2022-23046 SQL injection in phpIPAM 1.4.4. Allows authenticated admin users to extract database info, read files, and write to the server.
Proof-of-concept exploit for CVE-2022-23046, an authenticated SQL injection in PhpIPAM v1.4.4. Extracts server info, SMTP settings, user hashes, and database credentials via the edit-bgp-mapping-search.php endpoint.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.