XFileSharing Free - Hacked or Bug?

[Jing]

I recently received uploads from ip address 127.0.0.1. And that's quite impossible because that's the local ip address of the server. So I'm wondering if there is a bug or is there an exploit for the script?

Here's a screenshot.



Thanks!

[PilgrimX182]

Don't think it's a hack. We use HTTP_X_FORWARDED_FOR header to get IP if available (allow to get ip behind the proxy) - I guess this dude just use local proxy on his computer.

If you would like to use standard method you can find in Session.pm

Code: Select all

return $ENV{HTTP_X_FORWARDED_FOR} || $ENV{REMOTE_ADDR};

and replace with

Code: Select all

return $ENV{REMOTE_ADDR};

[Jing]

Oh thanks. It got me worried for a while.