CVE-2022-23046

EPSS 25.2%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (4 stars) — exploitation code widely available.

CVSS —EPSS 25.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

19 Jan 2022Published on NVD

22 Jan 2022Public PoC

Weaponization speed

3 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php

Affected products

n/a · PhpIPAM

public PoCs found — 6

githubgithub.com/dnr6419/CVE-2022-23046★ 4 githubgithub.com/bernauers/CVE-2022-23046★ 1 githubgithub.com/jcarabantes/CVE-2022-23046★ 1 githubgithub.com/hadrian3689/phpipam_1.4.4★ 0 cve_referencepacketstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.htmlunverified exploitdbwww.exploit-db.com/exploits/50684unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.html https://fluidattacks.com/advisories/mercury/https://github.com/phpipam/phpipam/releases/tag/v1.4.5