IP Spoofing Vulnerability in Likeshop by C2at3

CVE-2024-41432

What is CVE-2024-41432?

An IP Spoofing vulnerability has been identified in Likeshop that impacts versions up to 2.5.7.20210811. This security flaw allows attackers to manipulate their IP address by injecting false 'X-Forwarded' or 'Client-IP' headers in their requests. This capability enables them to bypass crucial security measures, such as account lockout protocols, when attempting unauthorized access to admin accounts. Furthermore, the vulnerability allows for the impersonation of previously authenticated IP addresses, which can lead to serious security breaches and unauthorized actions within user accounts.

References