CVE-2022-23046
Published: 19 January 2022
Summary
CVE-2022-23046 is a high-severity SQL Injection (CWE-89) vulnerability in Phpipam Phpipam. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
PhpIPAM version 1.4.4 contains a SQL injection vulnerability classified under CWE-89. The flaw resides in the app/admin/routing/edit-bgp-mapping-search.php component, where the "subnet" parameter used during subnet searches is not properly sanitized, allowing an authenticated administrator to supply crafted input that is interpreted as SQL statements.
An authenticated administrator can exploit the issue over the network without user interaction to execute arbitrary SQL queries against the underlying database. Successful exploitation can result in disclosure, modification, or deletion of database contents, corresponding to the CVSS 7.2 rating that reflects high impact across confidentiality, integrity, and availability.
The phpIPAM project addressed the flaw in release v1.4.5. Public advisories from Fluid Attacks and proof-of-concept material on Packet Storm document the injection vector and confirm that upgrading to the patched version mitigates the exposure. The associated EPSS score has remained at its recorded peak of 0.4898 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28156
Vulnerability details
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.