CVE-2026-37604 in pH7Builder
Summary
by MITRE • 09/22/2026
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in pH7Builder versions through 18.2.0 represents a critical failure in input validation and trust boundary enforcement within the application's network layer. Specifically, the flaw resides in the IP address resolution logic located in the file _protected/framework/Ip/Ip.class.php. The software is designed to determine the client's originating IP address by inspecting HTTP headers such as HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR. These headers are commonly used in web architectures that sit behind load balancers, reverse proxies, or content delivery networks to preserve the original visitor's IP address when direct connection information would otherwise reflect only the proxy server's address. However, the implementation fails to verify whether the request originates from a trusted proxy before accepting these header values as authoritative source identifiers. This lack of validation allows any remote unauthenticated attacker to manipulate the perceived client identity by injecting arbitrary values into these headers during HTTP requests.
The operational impact of this vulnerability is significant because it directly undermines security mechanisms that rely on IP-based identification for enforcement purposes. In pH7Builder, critical authentication controls such as login attempt counters and account lockout policies are keyed exclusively against the resolved client IP address. These measures are essential defenses against brute-force attacks, credential stuffing, and automated password guessing tools. By bypassing these throttling mechanisms, an attacker can perform unlimited failed login attempts without triggering any protective responses or temporary bans. This effectively neutralizes a primary defense layer intended to slow down unauthorized access attempts, thereby increasing the likelihood of successful compromise through offline cracking or persistent online brute-force campaigns against user accounts within the social dating platform.
From a technical classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-918 Server-Side Request Forgery (SSRF) related to header manipulation, though it is most accurately categorized under CWE-345 Insufficient Verification of Data Authenticity or more specifically as an IP Spoofing issue. In the context of the MITRE ATT&CK framework, this behavior facilitates techniques associated with Credential Access and Defense Evasion, particularly those involving brute force attacks where rate limiting controls are bypassed through header injection. The attacker leverages the HTTP_X_FORWARDED_FOR header to spoof their source address on each request, ensuring that the server treats every attempt as coming from a unique IP address, thus resetting or avoiding any cumulative thresholds established by the application's security logic.
To mitigate this vulnerability, immediate remediation is required within the pH7Builder codebase. The development team must implement strict validation for proxy-related headers. This involves configuring the application to only accept HTTP_X_FORWARDED_FOR and similar header values if they originate from known, trusted internal IP ranges or specific proxy servers configured in a whitelist. Alternatively, the most robust approach is to disable reliance on these headers entirely unless absolutely necessary for network topology reasons, instead relying solely on REMOTE_ADDR which reflects the direct TCP connection source address provided by the web server and operating system kernel. This ensures that only genuine client IPs are used for security policy enforcement such as rate limiting and account lockouts. Until a patch is applied, administrators should consider implementing external WAF rules or reverse proxy configurations to strip or validate these headers before they reach the application layer, thereby preventing attackers from manipulating IP-based throttling mechanisms remotely.