SQL Injection Vulnerability in phpipam by phpipam
CVE-2026-4189

5.1MEDIUM

Key Information:

Vendor

phpipam

Status
PHPipam
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-4189?

A vulnerability has been detected in phpipam versions up to 1.7.4, primarily within the section handler component, specifically in the 'edit-result.php' file. By exploiting inadequate sanitization of the 'subnetOrdering' argument, an attacker may execute SQL injection attacks remotely. This flaw poses a significant threat as it can allow unauthorized access to the database and potentially compromise sensitive information. Despite early notifications sent to the vendor regarding this issue, no response was received, raising concerns over the availability of patches or solutions for affected users. Organizations utilizing this application are strongly urged to assess their systems for vulnerability and apply necessary mitigations.

Affected Version(s)

phpipam 1.7.0

phpipam 1.7.1

phpipam 1.7.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-4189 - Proof of Concept

References

https://vuldb.com/?id.351095
vdb-entrytechnical-description
https://vuldb.com/?ctiid.351095
signaturepermissions-required
https://vuldb.com/?submit.769933
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

rodtvs (VulDB User)
VulDB
.