Georgeo

**Name of the Vulnerable Software and Affected Versions** phpIPAM version 1.4 **Description** The issue is related to a lack of protection against SQL structure manipulation in the app/admin/custom-fields/edit.php component of the phpIPAM web application. This can be exploited by a remote attacker to execute arbitrary SQL queries when the `table` parameter is used with `action=add`. **Recommendations** For phpIPAM version 1.4, as a temporary workaround, consider restricting access to the `app/admin/custom-fields/edit.php` component until a patch is available. Avoid using the `table` parameter in the affected endpoint when `action=add` is used, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpIPAM version 1.4 **Description** The issue is related to a lack of protection against SQL query structure manipulation in the app/admin/custom-fields/filter-result.php component of the phpIPAM web application. This can be exploited by a remote attacker to execute arbitrary SQL queries. **Recommendations** For phpIPAM version 1.4, consider restricting access to the `filter-result.php` file until a patch is available, and avoid using the `table` parameter in the affected API endpoint when `action=add` is used. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpIPAM version 1.4 **Description** The issue is related to a lack of protection against SQL structure manipulation in the app/admin/custom-fields/order.php component of the phpIPAM web application. This can be exploited by a remote attacker to execute arbitrary SQL queries when the `table` parameter is used with `action=add`. **Recommendations** For phpIPAM version 1.4, as a temporary workaround, consider restricting access to the `app/admin/custom-fields/order.php` component until a patch is available. Avoid using the `table` parameter in the affected endpoint when `action=add` is used, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpIPAM version 1.4 **Description** The issue is related to a lack of protection against SQL query structure manipulation in the app/admin/custom-fields/edit-result.php component of the phpIPAM web application. This can be exploited by a remote attacker to execute arbitrary SQL queries. **Recommendations** For phpIPAM version 1.4, consider restricting access to the `app/admin/custom-fields/edit-result.php` component until a patch is available, and avoid using the `table` parameter with `action=add` to minimize the risk of exploitation.