CVE-2019-16692

published 2019-09-22

CVE-2019-16692: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
phpipam	phpipam	<= 1.4	—

Detection & IOCs extracted from sources · hover to see the quote

url http://{host}/app/admin/custom-fields/filter-result.php↗

path /app/admin/custom-fields/filter-result.php↗

command table=users`where 1=(updatexml(1,concat(0x3a,({cmd})),1))#`↗

• → Detect POST requests to /app/admin/custom-fields/filter-result.php with the 'action' parameter set to 'add' and a 'table' parameter containing SQL injection patterns (backticks, updatexml, concat, XPATH error-based payloads). ↗
• → Look for the error-based SQL injection fingerprint in HTTP responses: 'SQLSTATE[HY000]: General error: 1105 XPATH syntax error' — this indicates successful exploitation via updatexml(). ↗
• → Flag POST bodies to filter-result.php where the 'table' parameter contains backtick characters combined with 'updatexml', 'concat', and hex-encoded values (e.g., 0x3a), indicative of error-based XPATH SQL injection. ↗
• → Monitor for sequential POST requests to filter-result.php with varying SQL commands in the 'table' field (e.g., select user(), select system_user(), select @@version, select @@datadir, select @@hostname), indicating automated enumeration. ↗

• · The exploit requires valid authenticated credentials to phpIPAM before the SQL injection can be triggered — unauthenticated exploitation is not possible with this technique. ↗
• · The exploit was tested specifically against phpIPAM 1.4 on Ubuntu 18.04 with MariaDB 10.4; behavior on other database backends may differ. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89