CVE-2026-44450: Critical SQL Injection in phpIPAM

Detection and triage priorities

Start by identifying all phpIPAM instances and mapping them to versions. Prioritize systems that are internet-facing, reachable from partner networks, or accessible from low-trust internal segments. Then review web logs and upstream reverse proxy logs for requests to the affected path: /app/admin/routing/edit-bgp-mapping-search.php. Focus on suspicious values in the vrf parameter, especially characters and keywords associated with SQLi testing.

You should also correlate web activity with database error logs and application anomalies. SQL injection attempts often generate traceable indicators such as syntax errors, unusual UNION queries, access pattern spikes, or malformed requests containing ', ", %27, comment delimiters, or time-based payload elements. If you do not have high-fidelity phpIPAM-specific logging, use your web tier, WAF, or reverse proxy as the primary observation point.

Technical Notes

Suspicious web log patterns

Look for direct requests to the affected endpoint with SQL metacharacters in vrf:

/app/admin/routing/edit-bgp-mapping-search.php?vrf='
/app/admin/routing/edit-bgp-mapping-search.php?vrf=1%27%20OR%20%271%27%3D%271
/app/admin/routing/edit-bgp-mapping-search.php?vrf=1%20UNION%20SELECT
/app/admin/routing/edit-bgp-mapping-search.php?vrf=1%27%20AND%20SLEEP(5)--%20

Example grep for Apache or Nginx access logs

grep -Ei 'edit-bgp-mapping-search.php.*vrf=.*(%27|%22|union|select|sleep(|--|/*|or|and)' /var/log/nginx/access.log /var/log/apache2/access.log

Example Splunk query

index=web_logs ("edit-bgp-mapping-search.php")
| rex field=uri_query "(?i)vrf=(?<vrf>[^&]+)"
| search vrf="*%27*" OR vrf="*'*" OR vrf="*union*" OR vrf="*select*" OR vrf="*sleep(*" OR vrf="*--*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, http_method, uri, vrf, status

Example Sigma-style logic concept

title: phpIPAM edit-bgp-mapping-search suspicious vrf parameter
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: "/app/admin/routing/edit-bgp-mapping-search.php"
  keywords:
    cs-uri-query|contains:
      - "vrf=%27"
      - "vrf='"
      - "UNION"
      - "SELECT"
      - "SLEEP("
      - "--"
  condition: selection and keywords
level: high

Mitigation and patching guidance

The preferred remediation is to upgrade phpIPAM to the first release that includes upstream commit 6654db6676fdd9f364f3ea1515db7fe4c8fcc620. Because the exact fixed release number was not directly confirmed in the retrieved source set, security teams should validate release contents before closing the issue. If your deployment comes from source control, confirm the commit is present. If it comes from a package or container, verify the package changelog or image digest against vendor release notes.

If immediate upgrade is not possible, reduce exposure aggressively. Restrict access to phpIPAM management interfaces at the network layer, place the application behind authentication-aware reverse proxy controls where appropriate, and ensure the vulnerable admin/routing path is not reachable by untrusted users. Since upstream notes indicate a fix also involved allowing search only from the admin section for authenticated users, enforcing authenticated-only access to the relevant functionality is a reasonable short-term risk-reduction step, though it is not equivalent to a code fix.

Technical Notes

Check whether the fix commit exists in a source-based deployment

cd /var/www/phpipam
git rev-parse HEAD
git log --oneline --decorate --grep 6654db6676fdd9f364f3ea1515db7fe4c8fcc620
git branch --contains 6654db6676fdd9f364f3ea1515db7fe4c8fcc620

Upgrade from upstream source

If you manage phpIPAM as a Git checkout, update to a vendor-supported revision that includes the fix:

cd /var/www/phpipam
git fetch --all --tags
git pull --ff-only
git branch --contains 6654db6676fdd9f364f3ea1515db7fe4c8fcc620

If your process requires pinning to a specific release, stop and verify which release first contains the commit before deployment.

Short-term reverse proxy restriction example (Nginx)

Restrict access to the vulnerable endpoint to trusted admin networks only:

location = /app/admin/routing/edit-bgp-mapping-search.php {
    allow 192.0.2.0/24;
    allow 198.51.100.0/24;
    deny all;
}

Then reload:

sudo nginx -t && sudo systemctl reload nginx

Short-term Apache restriction example

<Location "/app/admin/routing/edit-bgp-mapping-search.php">
    Require ip 192.0.2.0/24 198.51.100.0/24
</Location>

Then reload:

sudo apachectl configtest && sudo systemctl reload apache2

These workarounds reduce exposure but do not remove the underlying SQL injection if reachable by an allowed client.

Incident response and validation checklist

If you discover an exposed vulnerable instance, treat it as potentially compromised until log review is complete. SQL injection into management software can result in quiet data theft or subtle record manipulation rather than obvious outages. Review recent changes to network inventory, BGP-related mappings, and administrative records. Also assess whether database credentials used by phpIPAM have excessive privileges.

After patching or restricting access, validate from both a defensive and operational angle. Confirm that the vulnerable path is no longer reachable from untrusted networks, verify the application still functions for authorized admins, and tune detections for the affected endpoint for at least several weeks after remediation. Attackers often continue probing published vulnerable paths after fixes become available.

References

• NVD: CVE-2026-44450
• Upstream fix commit: GitHub Commit
• Upstream issue #4332: GitHub Issue
• Related pull request #4328: GitHub Pull Request
• Tenable CVE summary: Tenable CVE Summary
• VulDB secondary-source entry: VulDB Entry

For more information on network security practices, check out our articles on what is log retention and how to validate your SIEM and EDR detections without guesswork.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.