Attack Chain

1. Attacker performs reconnaissance to identify a target web server running phpSysInfo 3.4.5.
2. Attacker interacts with 'xml.php' to confirm that IP allowlisting is enforced, receiving a 'Client IP address ... not allowed' message.
3. Attacker identifies the target's IP allowlist configuration by trial or auxiliary discovery if applicable.
4. Attacker crafts an HTTP request to 'xml.php'.
5. Attacker injects the 'X-Forwarded-For' or 'Client-IP' HTTP header containing an IP address authorized in the application's configuration.
6. The web server passes the spoofed header to the vulnerable 'read_config.php' logic.
7. The application incorrectly validates the spoofed header as the source IP and grants access.
8. The application serves the sensitive system information XML to the unauthorized attacker.

Impact

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to system-level diagnostic and configuration information that is intended to be restricted to specific administrative IP addresses. This information disclosure can facilitate further attacks by revealing underlying system architecture, kernel versions, hardware components, and potentially sensitive environment paths or configuration details.

Recommendation

• Upgrade all instances of phpSysInfo to version 3.4.6 or later immediately to implement trusted proxy validation.
• Apply the Sigma rule provided below to monitor for incoming HTTP requests that use non-standard IP-identifying headers in a way that suggests exploitation attempts.
• Configure the web server (e.g., Apache/Nginx) to ignore or scrub 'X-Forwarded-For' and 'Client-IP' headers from external requests unless they originate from a known, trusted internal proxy.
• Review access logs for 'xml.php' requests originating from unexpected IP addresses that also contain 'X-Forwarded-For' headers, which may indicate exploitation attempts against this CVE.