phpSysInfo IP Allowlist Bypass

phpSysInfo versions 3.4.5 and earlier contain a critical configuration vulnerability (CVE-2026-55584) related to how the application determines the client's IP address. The application uses a trust-all approach to HTTP headers such as 'X-Forwarded-For' and 'Client-IP' to verify if a request originates from an authorized address defined in the PSI_ALLOWED configuration. Because there is no mechanism to validate that these headers are coming from a trusted proxy, an unauthenticated remote attacker can inject an authorized IP address into these headers. This manipulation defeats the allowlist protection and provides the attacker with access to the full system information XML exposed through the 'xml.php' endpoint, which contains system configuration, hardware details, and potentially sensitive environment data. This vulnerability was addressed in version 3.4.6.

Attack Chain

1. Attacker performs reconnaissance to identify a target web server running phpSysInfo 3.4.5.
2. Attacker interacts with 'xml.php' to confirm that IP allowlisting is enforced, receiving a 'Client IP address ... not allowed' message.
3. Attacker identifies the target's IP allowlist configuration by trial or auxiliary discovery if applicable.
4. Attacker crafts an HTTP request to 'xml.php'.
5. Attacker injects the 'X-Forwarded-For' or 'Client-IP' HTTP header containing an IP address authorized in the application's configuration.
6. The web server passes the spoofed header to the vulnerable 'read_config.php' logic.
7. The application incorrectly validates the spoofed header as the source IP and grants access.
8. The application serves the sensitive system information XML to the unauthorized attacker.

Impact

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to system-level diagnostic and configuration information that is intended to be restricted to specific administrative IP addresses. This information disclosure can facilitate further attacks by revealing underlying system architecture, kernel versions, hardware components, and potentially sensitive environment paths or configuration details.

Recommendation

• Upgrade all instances of phpSysInfo to version 3.4.6 or later immediately to implement trusted proxy validation.
• Apply the Sigma rule provided below to monitor for incoming HTTP requests that use non-standard IP-identifying headers in a way that suggests exploitation attempts.
• Configure the web server (e.g., Apache/Nginx) to ignore or scrub 'X-Forwarded-For' and 'Client-IP' headers from external requests unless they originate from a known, trusted internal proxy.
• Review access logs for 'xml.php' requests originating from unexpected IP addresses that also contain 'X-Forwarded-For' headers, which may indicate exploitation attempts against this CVE.