关联漏洞
标题:phpIPAM 授权问题问题漏洞 (CVE-2023-0678)Description:phpIPAM是一套开源的基于PHP和MySQL的IP地址管理应用程序（IPAM）。 phpIPAM 1.5.1之前版本存在授权问题漏洞，攻击者利用该漏洞可以通过 find_full_subnets.php 端点下载包含敏感信息。
Description
In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via find_full_subnets.php endpoint. The bug lies in the fact that find_full_subnets.php does not verify if the user is authorized to access the data, and if the script was started from a command line.
文件快照
id: CVE-2023-0678
info:
name: PHPIPAM <v1.5.1 - Missing Authorization
author: princechaddha,rit
...
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。