CVE-2022-1226

Summary

CVE-2022-1226 is a Cross-Site Scripting (XSS) vulnerability affecting phpipam/phpipam versions prior to 1.4.7. The issue lies in the import Data set feature, allowing attackers to execute arbitrary JavaScript code in victims' browsers through specially crafted spreadsheet files. Affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. Exploitation occurs upon uploading these malicious files, potentially leading to website defacement, malicious JavaScript execution, user cookie theft, and unauthorized user account access.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.