Description
PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepresent their IP address by sending a modified header.
References
- 15326 vdb-entry
- 17433 third-party-advisory
- http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt
- 17425 third-party-advisory