CVE-2024-10720: Phpipam Device Management XSS Vulnerability

CVE-2024-10720 Overview

CVE-2024-10720 is a stored cross-site scripting (XSS) vulnerability in phpIPAM version 1.5.2, an open-source IP address management application. The flaw resides in the Device Management section under Administration, where the Name and Description fields accept unsanitized input when adding a new device type. An authenticated attacker can inject malicious JavaScript that executes in the browser of any user who views the affected device data. Successful exploitation enables session theft, account compromise, malware distribution, defacement, and phishing. The issue is tracked under [CWE-79] and is fixed in phpIPAM version 1.7.0.

Critical Impact
Stored JavaScript payloads persist in the phpIPAM database and execute for every administrator or user browsing Device Management, enabling session hijacking and privilege abuse.

Affected Products

phpIPAM version 1.5.2
Earlier phpIPAM releases sharing the vulnerable Device Management input handling
Fixed in phpIPAM version 1.7.0

Discovery Timeline

2025-03-20 - CVE-2024-10720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10720

Vulnerability Analysis

The vulnerability is a stored XSS issue that occurs when an authenticated user with administrative access adds a new device type through the Device Management interface. The application accepts input in the Name and Description fields without sanitizing HTML or JavaScript payloads. The unsanitized data is written directly to the backing database.

When any subsequent user loads a page that renders the device type list, the injected script executes in that user's browser context. Because the payload lives in the database, every visit to affected views triggers execution. The impact scales with the privilege of the viewing user, since phpIPAM administrators can access network configuration data, credentials, and account controls.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application trusted administrator-supplied device type metadata and did not apply output encoding when rendering the values back to the DOM. The upstream fix restructures database query handling to enforce a safe-by-default strategy for string data. The remediation commit c1697bb6c4e4a6403d69c0868e1eb1040f98b731 updates getObjectsQuery call sites to include an explicit table context, tightening how string data flows through the persistence layer.

Attack Vector

Exploitation requires network access to the phpIPAM web interface and an authenticated account permitted to add device types. The attacker submits a crafted payload in the Name or Description field. The payload persists and executes when another user, typically an administrator, browses the Device Management view. Because the scope changes across users, the attack can pivot from a lower-privileged operator to a full administrator session.

php

// Patch excerpt: api/controllers/Devices.php
// Refactor: Safe by default strategy of database string data v2
                    $search_query = $base_query . $extended_query;

                    # Search query
-                    $result = $this->Database->getObjectsQuery($search_query, $query_params);
+                    $result = $this->Database->getObjectsQuery('devices', $search_query, $query_params);

                    // result
                    if(!$result)     { return $this->Response->throw_exception(404, "No devices found"); }

Source: phpIPAM commit c1697bb

php

// Patch excerpt: api/controllers/Prefix.php
        $query = "select * from `subnets` where `".$this->custom_field_name."` = ? $limit order by `".$this->custom_field_orderby."` ".$this->custom_field_order_direction.";";
        $params = array($this->_params->id);
        // search
-        try { $subnets = $this->Database->getObjectsQuery($query, $params); }
+        try { $subnets = $this->Database->getObjectsQuery('subnets', $query, $params); }
        catch (Exception $e) { $this->Response->throw_exception(500, "Error: ".$e->getMessage()); }

Source: phpIPAM commit c1697bb

Detection Methods for CVE-2024-10720

Indicators of Compromise

Device type entries containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the Name or Description columns of the phpIPAM database.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading the Device Management view.
New or modified phpIPAM user accounts, API tokens, or permission changes that follow suspicious device type edits.

Detection Strategies

Query the phpIPAM database for device type records whose text fields contain angle brackets, javascript: URIs, or common XSS event handlers.
Review web server access logs for POST requests to Device Management endpoints followed by session activity from unusual source addresses.
Enable and inspect Content Security Policy (CSP) violation reports to surface inline script execution originating from phpIPAM pages.

Monitoring Recommendations

Alert on modifications to device type records made by non-administrative or newly created accounts.
Correlate phpIPAM audit logs with web proxy telemetry to identify script-driven data exfiltration.
Monitor for lateral movement or credential misuse originating from workstations that recently accessed the phpIPAM administration interface.

How to Mitigate CVE-2024-10720

Immediate Actions Required

Upgrade phpIPAM to version 1.7.0 or later, which contains the safe-by-default database string handling refactor.
Audit existing device type entries and remove any records containing HTML or JavaScript payloads before upgrading.
Rotate phpIPAM administrator credentials and API tokens if suspicious device type modifications are found.

Patch Information

The upstream fix is committed as c1697bb6c4e4a6403d69c0868e1eb1040f98b731 in the phpIPAM repository and shipped in version 1.7.0. Review the phpIPAM security commit and the Huntr Bounty Report for full technical context before deploying.

Workarounds

Restrict access to the Device Management section to a minimal set of trusted administrators using role-based permissions.
Place phpIPAM behind a web application firewall with rules that block script tags and common XSS payloads in POST parameters.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored payloads.

bash

# Example CSP header for the phpIPAM virtual host (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;