phpipam Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in phpipam/phpipam version 1.5.2. This vulnerability allows attackers to inject malicious scripts that are executed in the context of users viewing the affected pages. The issue arises when editing the NAT destination address, as user input is not properly sanitized. This can result in data theft, account compromise, and other malicious activities. The vulnerability has been addressed in version 1.7.0.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of users viewing the affected pages.

Reproduction

The vulnerability can be reproduced by editing the NAT destination address in phpipam version 1.5.2. During this process, injected scripts are not properly sanitized, leading to the execution of malicious scripts in the context of other users.

Remediation

Users can upgrade to phpipam version 1.7.0 or later to address this vulnerability.