Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Request IP form of phpIPAM version 1.7.3. It allows remote attackers to inject arbitrary web scripts or HTML code through the 'instructions' parameter in the /app/admin/instructions/edit-result.php endpoint.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could execute malicious scripts in the context of the affected web application, potentially leading to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to inject malicious scripts that can potentially expose sensitive information such as user credentials. This exposure of sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or disclosure. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a POST request to the endpoint /app/admin/instructions/edit-result.php with a crafted payload in the instructions parameter that includes a form with a button triggering a JavaScript prompt. For example, you can use a command like: curl -X POST -d "instructions=<form><input hidden id='username' name='username'/><input hidden id='password' name='password' type='password'/><button formaction='javascript:javascript:prompt(\'XSS Present\')'>Click Here To Request IP</button></form>" http://<target-ip>/app/admin/instructions/edit-result.php Then, navigate to the Request IP page and click the "Click Here To Request IP" button. If a prompt displaying "XSS Present" appears, the vulnerability is present. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade phpIPAM to version 1.7.4 or later, as this version contains the fix for the vulnerability. The fix was committed on November 17, 2025, and version 1.7.4 was released on November 27, 2025. Until the upgrade can be performed, restrict access to the affected endpoint and ensure only trusted users have access to the Request IP form to reduce the risk of exploitation. [2]

Useful 0 Not Useful 0