Submit #52595: Http Header Injection in [Geolocation IP Detection] wordpress plugin
| Title | Http Header Injection in [Geolocation IP Detection] wordpress plugin |
|---|---|
| Description | http header injection vulnerability that could be manipulated HTTP real IP with x-forwarded-for header 1. install Geolocation IP Detection wordpress plugin https://wordpress.org/plugins/geoip-detect/ 2. send request for visit setting page with x-forwarded-for: [REDACTED_IP] 3. show spoofed IP address in response POC: https://drive.google.com/file/d/1iXfYmYMdB0gPbSjZscSdF8zLlA6PZZJA/view?usp=sharing https://drive.google.com/file/d/1pqxoFeuLBtYeknit_1r0afFD8QE9uLx8/view?usp=sharing |
| User | rezaduty (ID 10530) |
| Submission | 18/11/2022 20:15 (1 Year ago) |
| Moderation | 20/11/2022 13:56 (2 days later) |
| Accepted | تمت الموافقة |
| VulDB Entry | VDB-214044 |