CVE-2026-4189: phpIPAM SQL Injection Vulnerability

CVE-2026-4189 Overview

CVE-2026-4189 is a SQL injection vulnerability in phpIPAM versions up to 1.7.4. The flaw resides in the Section Handler component, specifically in app/admin/sections/edit-result.php. Attackers can manipulate the subnetOrdering argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely but requires high privileges to access the affected administrative endpoint. The exploit has been disclosed publicly, increasing the risk of opportunistic attacks. The phpIPAM maintainers were contacted prior to disclosure but did not respond.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL queries through the subnetOrdering parameter, potentially exposing or modifying IP address management data stored by phpIPAM.

Affected Products

phpIPAM versions up to and including 1.7.4
app/admin/sections/edit-result.php (Section Handler component)
Deployments exposing the phpIPAM administrative interface

Discovery Timeline

2026-03-16 - CVE-2026-4189 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-4189

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The defect exists in the Section Handler logic within phpIPAM, an open-source IP address management (IPAM) application. The edit-result.php script accepts the subnetOrdering parameter from a request and incorporates it into a SQL query without sufficient sanitization or parameterization. An authenticated user with administrative section access can submit a crafted value to alter the structure of the resulting query. Successful exploitation yields limited confidentiality, integrity, and availability impact against the backing database. The EPSS probability is 0.012%, reflecting low observed exploitation activity at this time, but a public proof of concept is available.

Root Cause

The root cause is unsafe handling of user-supplied input in an ORDER BY clause. The subnetOrdering parameter is concatenated into a SQL statement rather than validated against an allowlist of column names or bound as a parameter. Because ORDER BY values cannot be parameterized in most database drivers, developers must explicitly whitelist acceptable values. The absence of this control allows SQL fragments to reach the query planner.

Attack Vector

The attack is launched over the network against the phpIPAM web interface. The attacker authenticates with a privileged account, then issues a request to the Section Handler endpoint containing a malicious subnetOrdering value. The injected SQL is executed in the context of the phpIPAM database user. Public exploit code lowers the technical barrier for adversaries. See the VulDB entry for CVE-2026-4189 for additional technical context.

No verified exploit code is reproduced here. Refer to the VulDB CTI record #351095 for analyst observations on this issue.

Detection Methods for CVE-2026-4189

Indicators of Compromise

HTTP requests to app/admin/sections/edit-result.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences in the subnetOrdering parameter.
Anomalous database errors or unusually long query execution times logged by the phpIPAM database backend.
Authenticated administrative sessions originating from atypical source addresses or user agents preceding manipulation of the Section Handler.

Detection Strategies

Inspect web server access logs for non-alphanumeric values supplied to subnetOrdering and alert on patterns that deviate from expected column names.
Enable database query auditing to capture ORDER BY clauses containing untrusted tokens or stacked statements.
Deploy a web application firewall (WAF) rule that blocks SQL injection signatures targeting the edit-result.php endpoint.

Monitoring Recommendations

Forward phpIPAM application logs, web server logs, and database audit logs to a centralized SIEM for correlation.
Baseline normal administrative activity and alert on spikes in section editing or ordering operations.
Review privileged phpIPAM account usage for credential reuse or session anomalies that could precede exploitation.

How to Mitigate CVE-2026-4189

Immediate Actions Required

Restrict network access to the phpIPAM administrative interface using IP allowlists, VPN, or reverse proxy authentication.
Audit and reduce the number of accounts holding administrative privileges within phpIPAM.
Rotate credentials for the phpIPAM database user and ensure it operates with least privilege on the IPAM schema only.

Patch Information

No vendor patch has been published at the time of NVD record update on 2026-04-29. The vendor did not respond to coordinated disclosure outreach. Monitor the phpIPAM project releases for an updated build that addresses the subnetOrdering parameter handling, and apply it as soon as it becomes available.

Workarounds

Place phpIPAM behind a WAF and block requests where subnetOrdering contains characters outside an allowlist of known sort column names.
Apply a local source-code fix to app/admin/sections/edit-result.php that validates subnetOrdering against a hardcoded list of permitted column identifiers before query construction.
Disable or remove access to the Section Handler edit endpoint until a vendor fix is released, if the workflow can tolerate the loss of functionality.

bash

# Example WAF rule (ModSecurity) restricting subnetOrdering to safe tokens
SecRule ARGS:subnetOrdering "!@rx ^[A-Za-z_]{1,32}( (ASC|DESC))?$" \
    "id:1042026,phase:2,deny,status:403,log,\
    msg:'CVE-2026-4189 phpIPAM subnetOrdering SQLi attempt'"