Executive brief
pH7Builder is an open-source platform for building dating sites and social networks. The admin login protection uses rate-limiting based on the client IP address, but the application trusts untrusted HTTP headers to determine that IP. An attacker can bypass login attempt throttling by spoofing a different IP address on each password guess, enabling rapid credential guessing without triggering account lockouts.
Technical details
The vulnerability exists in Ip.class.php, where the application resolves client IP from HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying these come from a trusted proxy. The admin login attempt counter and temporary lockout are keyed on this attacker-controlled IP value, allowing an unauthenticated remote attacker to reset rate-limit state per request by sending a different header value, bypassing all login throttling controls (CWE-290).
Affected products
- pH7Software pH7Builder through 18.2.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in version 18.3.0