Description
A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to use of less trusted source. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Metrics
CVSS 3.1 5.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | PbootCMS | 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; 3.2.7; 3.2.8; 3.2.9; 3.2.10; 3.2.11; 3.2.12 |
References
- https://note-hxlab.wetolink.com/share/JyBNgF8JagWQExploit, Third Party Advisory
- https://vuldb.com/?ctiid.338532Permissions Required, VDB Entry
- https://vuldb.com/?id.338532Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.719818Third Party Advisory, VDB Entry
Timeline
- Published
- Dec 28, 2025
- Last modified
- Oct 13, 2026
- NVD status
- Analyzed