Executive brief
phpSysInfo is a system monitoring application that displays server information like CPU, memory, and network configuration. Organizations often restrict access to this tool using an IP allowlist to prevent unauthorized information disclosure. However, the application trusts attacker-controlled HTTP headers (X-Forwarded-For and Client-IP) for IP validation before checking the actual client IP, allowing unauthenticated attackers to spoof a trusted IP address and completely bypass the access restriction.
Technical details
This is an authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) in the IP-based access control mechanism. The vulnerable code in read_config.php checks HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP headers before using REMOTE_ADDR to determine the client's IP address. Since these headers are fully attacker-controlled and there is no concept of trusted reverse proxies or proper chain parsing, an attacker can trivially spoof any allowed IP address. The vulnerability has no authentication requirement, requires no user interaction, and is exploitable over the network. An attacker can immediately obtain complete system information including hostname, kernel version, CPU model, memory layout, mounted filesystems, and network interface addresses—valuable reconnaissance data for targeting further attacks. The vulnerability affects all versions up to and including 3.4.5; version 3.4.6 and later include a fix that validates the request only comes from a configured trusted proxy before honoring forwarded headers.
Affected products
- phpsysinfo phpSysInfo <= 3.4.5
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Version 3.4.6 released with fix
- 2026-08-28: advisory: Advisory updated with additional details