phpIPAM 1.4.4 - Stored XSS


Name phpIPAM 1.4.4 - Stored XSS
Code name Osbourne
Product phpIPAM
Affected versions 1.4.4
Fixed versions 1.4.5
State Public
Release date 2022-01-18


Kind Stored cross-site scripting (XSS)
Rule 010. Stored cross-site scripting (XSS)
Remote Yes
CVSSv3 Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSSv3 Base Score 4.8
Exploit available No
CVE ID(s) CVE-2022-23045


phpIPAM v1.4.4 allows an authenticated admin user to inject persistent javascript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.

Proof of Concept

Steps to reproduce:


  1. Go to "".
  2. Update the "Site Title" parameter with " autofocus onfocus=alert(1)>.
  3. Click on 'Save'.
  4. If a user visits the settings page the javascript code will be rendered.

Open redirect:

  1. Go to "".
  2. Update the "Site Title" parameter with 0;url=" http-equiv="refresh".
  3. Click on 'Save'.
  4. If a user reloads the page, they will be redirected to

System Information

  • Version: phpIPAM IP address management v1.4.4.
  • Operating System: Linux.
  • Web Server: Apache
  • PHP Version: 7.4
  • Database and version: Mysql


There is no exploit for the vulnerability but can be manually exploited.


An updated version of phpIPAM is available at the vendor page.


The vulnerability was discovered by Oscar Uribe from the Offensive Team of Fluid Attacks.


Vendor page
Patched version


  • 2022-01-06: Vulnerability discovered.

  • 2022-01-07: Vendor contacted.

  • 2022-01-07: Vendor replied acknowledging the report.

  • 2022-01-17: Vulnerability patched.

  • 2022-01-18: Public Disclosure.