Executive Summary

CVE-2026-4189 is a SQL injection vulnerability in phpipam versions up to 1.7.4, specifically in the file app/admin/sections/edit-result.php within the Section Handler component.

The vulnerability arises from improper handling of the subnetOrdering parameter, which allows an authenticated administrator to inject malicious SQL commands that are stored and later executed when viewing subnets.

This is a second order SQL injection where the injected payload is stored in the database and executed later in an unsafe SQL query, particularly in the ORDER BY clause.

The injection is time-based blind and constrained by the database column length (VARCHAR(16)), limiting the payload size.

Exploitation requires administrative authentication and can be remotely performed. The vendor was notified but did not respond.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact the confidentiality, integrity, and availability of the affected phpipam system.

• Confidentiality: An attacker could extract sensitive information from the database by injecting SQL commands.
• Integrity: The attacker could manipulate or corrupt data by injecting arbitrary SQL commands.
• Availability: Time-based SQL injection payloads like SLEEP() can cause delays or denial of service by making the system unresponsive.

Since exploitation requires administrative authentication, the attacker must have elevated privileges, but once exploited, the impact can be significant.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your phpipam installation includes the vulnerable file `app/admin/sections/edit-result.php` and if the `subnetOrdering` parameter is being manipulated. One detection method is using Google dorking with the query `inurl:app/admin/sections/edit-result.php` to find potentially vulnerable targets.

Additionally, detection can be performed by testing for time-based SQL injection in the `subnetOrdering` parameter. For example, an authenticated administrator can attempt to set the `subnetOrdering` parameter to a payload like `SLEEP(5)` and observe if the response time increases significantly, indicating SQL injection.

• Use Google dorking: `inurl:app/admin/sections/edit-result.php` to find vulnerable endpoints.
• As an authenticated admin, send a POST request to `/app/admin/sections/edit-result.php` with `subnetOrdering=SLEEP(5)` and observe if the subnet listing response is delayed.
• Monitor for unusual delays (e.g., ~20 seconds) in subnet list retrieval, which indicates successful time-based blind SQL injection.

Useful 0 Not Useful 0

Mitigation Strategies

There are no known official patches or mitigations published by the vendor for this vulnerability as of the disclosure date.

Immediate mitigation steps include restricting access to the vulnerable phpipam installation, especially limiting administrative access to trusted users only, since exploitation requires authenticated admin privileges.

Consider replacing phpipam with an alternative IP address management product that is not affected by this vulnerability.

• Restrict administrative access to phpipam to trusted personnel only.
• Monitor and audit admin activities for suspicious changes to the `subnetOrdering` parameter.
• Consider disabling or limiting access to the vulnerable endpoint `/app/admin/sections/edit-result.php` if possible.
• Plan to migrate to a secure alternative IP address management solution.

Useful 0 Not Useful 0