phpipam Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in phpipam/phpipam version 1.5.2. This vulnerability is located in the 'Device Management' section under 'Administration'. It allows an attacker to inject malicious scripts into the 'Name' and 'Description' fields while adding a new device type. The injected scripts could be executed later, potentially leading to data theft, account compromise, distribution of malware, website defacement, and phishing attacks.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to phpipam version 1.7.0 or later to address this vulnerability.