phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

Affected: Packagist: phpsysinfo/phpsysinfo

## Summary phpSysInfo's `PSI_ALLOWED` IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in `read_config.php` derives the client IP from the attacker-controlled `X-Forwarded-For` and `Client-IP` HTTP headers **before** falling back to `REMOTE_ADDR`. An attacker can send `X-Forwarded-For: <an allowed IP>` to impersonate a trusted address and gain full access to all exposed system information, defeating the only IP-based access restriction the application provides.

## Affected component - File: `read_config.php` - Versions: all versions up to and including 3.4.x (current `main`)

## Description When `PSI_ALLOWED` is configured, `read_config.php` enforces an IP allowlist. The client IP is resolved as follows:

```php if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) { $ip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } else { if (isset($_SERVER["HTTP_CLIENT_IP"])) { $ip = $_SERVER["HTTP_CLIENT_IP"]; } else { $ip = $_SERVER["REMOTE_ADDR"]; } } ```

Both `HTTP_X_FORWARDED_FOR` and `HTTP_CLIENT_IP` are fully attacker-controlled request headers. They are trusted unconditionally and take priority over `REMOTE_ADDR`. There is no concept of a configured/trusted reverse proxy, so even when phpSysInfo is exposed directly (no proxy in front), the spoofed header wins. As a result the allowlist provides no real protection.

## Proof of Concept Verified against phpSysInfo `3.4.x-main-d786ab2` running in a local Docker co…

Affected: Ubuntu:16.04:LTS: phpsysinfo, Ubuntu:18.04:LTS: phpsysinfo, Ubuntu:20.04:LTS: phpsysinfo, Ubuntu:22.04:LTS: phpsysinfo, Ubuntu:24.04:LTS: phpsysinfo, Ubuntu:26.04:LTS: phpsysinfo

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.