-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how getIPAddress() handled proxy IP validation. Pre-patch versions allowed $proxyIPs to be configured as a string/comma-list, which led to insufficient verification of client IP headers. The method checked multiple headers (X-Forwarded-For, Client-IP, etc.) without properly validating whether the connecting proxy itself was trusted, enabling IP spoofing if the server was behind a reverse proxy. The commit 5ca8c99 fundamentally changed $proxyIPs to require explicit proxy-IP-to-header mappings, and added validation checks that were previously missing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codeigniter4/framework | composer | < 4.2.11 | 4.2.11 |
Ongoing coverage of React2Shell