✍️ Description

A user without access to the software can inject a portion of HTML code in access logs.

🕵️‍♂️ Proof of Concept

Simulate login with a crafter Client-IP header like this:

curl -H 'Client-IP: <h1>INJECT</h1>' -d 'username=<your-usename>&password=<your-password>&op=login' 'http://localhost/<your-path>/?op=login'

The result is:

💥 Impact

This vulnerability can inject HTML code. Fortunately the field for ip address is only 15 characters, too small to inject javascript code. 📍 Location functions.php#L188 📍 Location functions.php#L188