CyberRota Analysis
AI-GeneratedphpSysInfo versions prior to 3.4.6 are vulnerable due to an inadequate access-control check in read_config.php, allowing remote unauthenticated attackers to exploit manipulated X-Forwarded-For and Client-IP headers. This vulnerability enables attackers to impersonate trusted clients and gain unauthorized access to sensitive system information, including hostname, kernel, CPU, memory, filesystem, and network-interface details. Organizations using affected versions should prioritize upgrading to version 3.4.6 to mitigate the risk of information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.