phpSysInfo EUVD-2026-67862

Exploitation requires that phpSysInfo is network-accessible over HTTP and that the PSI_ALLOWED directive is actively configured in phpsysinfo.ini - this is the specific mechanism being bypassed. The attacker must supply at least one IP address matching the allowlist in the spoofed header; common guesses (127.0.0.1, private RFC1918 ranges, or well-known public IPs) will frequently succeed since the PoC itself used 8.8.8.8. No authentication is required (CVSS PR:N), no user interaction is needed, and exploitation is not constrained by PHP version or web server (verified on PHP 8.2 with Apache). Deployments with no PSI_ALLOWED configured are not affected by this specific bypass - though such deployments are already fully unauthenticated and open. The primary limiting factors are: (1) the phpSysInfo endpoint must be reachable from the attacker's network, and (2) the PSI_ALLOWED feature must be enabled.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately models this vulnerability: it is network-exploitable with zero authentication and minimal complexity - a single curl invocation with a spoofed header is sufficient, as the publicly available Exploit-DB PoC (52648) demonstrates. There is no KEV listing, meaning official confirmation of active exploitation is absent at time of analysis; however, the trivially low attack complexity and fully public exploit code make the practical exploitation barrier effectively zero for any internet-exposed instance. Crucially, this bypass only affects deployments where PSI_ALLOWED is configured - the operators most impacted are precisely those who believed they had restricted access. The impact is bounded to confidentiality (C:H, I:N, A:N): the attacker receives reconnaissance-grade system data but cannot modify state or cause denial of service through this vulnerability alone. The CVSS score and the real-world risk signals are well-aligned here - this is a genuine high-priority finding for any exposed phpSysInfo deployment, not a high-CVSS-low-real-risk paper vulnerability.

An attacker discovers an internet-exposed phpSysInfo instance and issues a single HTTP GET to xml.php with the header X-Forwarded-For set to a known or guessed address from the PSI_ALLOWED list (common candidates include 127.0.0.1, RFC1918 ranges, or publicly known addresses such as 8.8.8.8 as shown in the published PoC). The server resolves the spoofed header as the authoritative client IP, bypasses the allowlist check, and returns the full system information XML including hostname, kernel version, CPU, memory, filesystems, and network interfaces. A working, no-compilation exploit is publicly documented on Exploit-DB (https://www.exploit-db.com/exploits/52648).