Description

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:18:29.487Z",
  "pubdate": "2026-08-28T20:18:29.487Z",
  "executiveSummary": "phpSysInfo versions prior to 3.4.6 are susceptible to an access control bypass vulnerability arising from improper trust in HTTP request headers.\nThe vulnerability is classified as an improper authentication or access control flaw where the application relies on spoofable headers to validate client identity.\nA remote, unauthenticated attacker can exploit this by manipulating X-Forwarded-For or Client-IP headers to impersonate authorized hosts listed in the PSI_ALLOWED configuration.\nSuccessful exploitation grants unauthorized access to sensitive system information, including kernel details, CPU metrics, memory statistics, filesystem structures, and network interface configurations.\nThis exposure poses a significant risk to reconnaissance efforts, as an attacker can gather internal infrastructure details that facilitate further targeted exploitation.\nThe vulnerability is exploitable over a network without prior authentication or privilege requirements, provided the attacker can reach the web interface and successfully spoof the expected client IP address.",
  "technicalDetails": "The vulnerability resides within the read_config.php file of the phpSysInfo application, which is responsible for enforcing access control via the PSI_ALLOWED configuration parameter.\nThe root cause of this security defect is the application's implementation of client IP address verification. When determining the source of a request, the logic prioritizes user-supplied HTTP headers—specifically X-Forwarded-For and Client-IP—over the authoritative and non-spoofable REMOTE_ADDR server variable.\nIn a standard web server environment, the REMOTE_ADDR variable represents the direct connection point to the server. Conversely, X-Forwarded-For and Client-IP headers are often added by proxies or load balancers but can be easily injected or modified by an attacker in an HTTP request to mislead the application logic.\nThe attack flow proceeds as follows: First, the attacker identifies a phpSysInfo instance that utilizes the PSI_ALLOWED access control list to restrict access to system diagnostics. Second, the attacker constructs a malicious HTTP request targeting read_config.php. Within this request, the attacker injects an X-Forwarded-For or Client-IP header containing an IP address that is present in the application's pre-configured allow-list.\nBecause the application logic prioritizes these headers, it incorrectly validates the attacker's request as originating from a trusted, authorized source. The application then bypasses the intended security gate, allowing the unauthorized client to access the sensitive system information typically protected by the access control mechanism.\nThe affected component is the internal authorization logic within read_config.php. This impacts all versions of phpSysInfo prior to 3.4.6. The exploitation process requires no authentication or special privileges, representing a significant risk to servers deployed with strict access control expectations.\nPost-exploitation, an attacker gains visibility into the host's underlying infrastructure. This data is critical for reconnaissance, providing insights into kernel versions for potential exploit targeting, memory and CPU load for DoS planning, and filesystem layouts for identifying sensitive directory structures."
}