| शीर्षक | PbootCMS 3.2.12 get_user_ip IP Address Spoofing |
|---|
| विवरण | An IP address spoofing vulnerability exists in PbootCMS <= 3.2.12. The get_user_ip() function in core/function/handle.php prioritizes the X-Forwarded-For HTTP header over REMOTE_ADDR without validating whether the request originates from a trusted proxy. This allows remote attackers to bypass the admin login lockout mechanism by spoofing different IP addresses for each failed login attempt, enabling unlimited brute force attacks against admin accounts. The default configuration locks users after 5 failed attempts for 15 minutes, but this protection is completely ineffective when attackers spoof their IP. Additionally, attackers can bypass IP-based blacklists and whitelists configured in the system. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/JyBNgF8JagWQ |
|---|
| उपयोगकर्ता | pemic (UID 93604) |
|---|
| सबमिशन | 19/12/2025 10:27 AM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 05:47 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338532 [PbootCMS तक 3.2.12 Header core/function/handle.php get_user_ip X-Forwarded-For] |
|---|
| अंक | 20 |
|---|