CVE-2025-60912: CSRF
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60912?
CVE-2025-60912 is classified as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2025-60912?
To fix CVE-2025-60912, it is recommended to update to a newer version of phpIPAM that addresses this vulnerability.
What are the potential impacts of CVE-2025-60912?
The potential impacts of CVE-2025-60912 include unauthorized database export operations by remote attackers.
Who is affected by CVE-2025-60912?
CVE-2025-60912 affects users of phpIPAM version 1.7.3 and potentially earlier versions.
How can attackers exploit CVE-2025-60912?
Attackers can exploit CVE-2025-60912 by sending crafted HTTP GET requests to trigger a database dump download.