{"id":"CVE-2026-37604","published":"2026-09-22T19:16:43.493","lastModified":"2026-09-23T16:16:42.820","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-ph7builder","tags":[]},{"url":"https://github.com/pH7Software/pH7-Social-Dating-CMS","tags":[]},{"url":"https://ph7builder.com","tags":[]}],"exploitRefs":[{"url":"https://github.com/pH7Software/pH7-Social-Dating-CMS","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows remote unauthenticated attackers to bypass IP-based throttling by manipulating the X-Forwarded-For header, leading to potential unauthorized access to admin functionalities.","exploitability":"Exploitation is relatively straightforward as attackers can send a different X-Forwarded-For value per request, requiring no specific preconditions other than the ability to modify HTTP headers.","blast_radius":"If exploited, this could lead to unauthorized access to admin features, potentially resulting in data breaches or system compromise.","remediation":"Upgrade to pH7Builder version 18.3.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","header-manipulation"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-27T08:49:54.890Z"}}