Easeprobe
Monthly
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
EaseProbe is a tool that can do health/status checking. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
EaseProbe is a tool that can do health/status checking. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.