Description

In phpIPAM 1.4.5, a normal user with the role of Usercould view/read the log files via show-logs.php, error_logs.php and access_logs.php endpoints. It is supposedly accessible by the Administrator only.

Proof of Concept

Tested version: phpIPAM 1.4.5

_

Affected endpoints:

1 GET/POST http://{HOST}/app/tools/logs/show-logs.php

2 POST http://{HOST}/app/dashboard/widgets/error_logs.php

3 POST http://{HOST}/app/dashboard/widgets/access_logs.php

_

Steps to reproduce:

1 Go to http://{HOST}/app/tools/logs/show-logs.php

2 Login as a user with the role of User.

3 We can read the log files detailing username, IP address, event, severity and date.

_

• In normal user UI
• PoC endpoint 1: GET
• PoC endpoint 1: POST
• PoC endpoint 2: POST
• PoC endpoint 3: POST

Impact

This vulnerability is capable of revealing sensitive data exposure of relevant parties such as username, IP address, event, severity and date. Since the normal user can view/collect relevant usernames, he/she could conduct a dictionary/brute-force attack on the login page to authenticate with. He/she could also know the origin IP address of the admin to further the attack.