The vulnerability in pH7Software pH7Builder up to version 18.2.0 lies in its IP address resolution method within _protected/framework/Ip/Ip.class.php. The software uses the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers to identify client IPs without validating that the request is from a trusted proxy. Since the admin login attempt counter and lockout are keyed on this IP value, an attacker can circumvent IP-based throttling by supplying different X-Forwarded-For header values in each request, enabling unlimited login attempts.

An unauthenticated remote attacker can bypass IP-based throttling and lockout protections on the admin login interface. This increases the risk of brute force attacks against admin credentials, potentially leading to unauthorized access if credentials are weak or compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling reliance on HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers for IP identification or implement additional verification to ensure these headers are only trusted from known proxies. Monitoring for unusual login patterns may also help detect exploitation attempts.