An unauthenticated attacker can perform an authentication bypass in phpSysInfo versions prior to 3.4.6, leading to the unauthorized disclosure of sensitive system configuration and hardware data.

This vulnerability is an authentication bypass caused by improper trust in HTTP headers (CWE-290). The application incorrectly prioritizes attacker-controlled X-Forwarded-For and Client-IP headers over the actual REMOTE_ADDR when performing access control checks in read_config.php.

Successful exploitation allows an unauthenticated remote attacker to bypass access controls and gain visibility into critical infrastructure details. This includes sensitive data such as system hostname, kernel versions, CPU architecture, memory usage, and network interface configurations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to organizational security by providing attackers with reconnaissance data necessary for further lateral movement or targeted exploitation.

Immediate Action: Update phpsysinfo to version 3.4.6 or later to ensure the application correctly validates client IP addresses.

Proactive Monitoring: Monitor server access logs for anomalous requests to read_config.php or unexpected IP addresses originating from untrusted network segments.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or strip X-Forwarded-For and Client-IP headers from external requests, or restrict access to the phpsysinfo directory to authorized IP ranges via server configuration.

Public Exploit Available: Yes, a public proof of concept is available via GitHub, and an entry exists in ExploitDB.

The severity of this vulnerability, combined with the availability of a public exploit, necessitates immediate action. Administrators must prioritize updating to version 3.4.6 to eliminate the authentication bypass risk. Organizations unable to patch immediately should apply strict network access controls to the affected script to prevent unauthorized reconnaissance.