phpSysInfo 3.4.5 – IP‑Allowlist Bypass (CVE‑2026‑55584)
What Happened – A logic flaw in phpSysInfo ≤ 3.4.5 allows an attacker to spoof the client IP via the X‑Forwarded‑For or Client‑IP HTTP headers. The application trusts these headers before falling back to REMOTE_ADDR, so an attacker can bypass the configured IP allowlist and retrieve the full system‑information XML payload from xml.php.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a classic control‑gap: reliance on unvalidated network‑layer data to enforce access restrictions, a scenario SOC 2 CC6 (Logical Access) expects you to mitigate and evidence.
- Continuous control monitoring (e.g., automated validation that only trusted proxy headers are honored) provides the audit‑ready evidence needed to demonstrate that “allowlist” controls are enforceable.
- Verisq’s Control‑Mapping capability can automatically map this vulnerability to the relevant SOC 2 controls and collect continuous evidence that the fix (defaulting to
REMOTE_ADDRand proxy‑whitelisting) is in place.
Who Is Affected – Organizations that host phpSysInfo on Linux/Apache/PHP stacks, spanning SaaS providers, managed‑hosting firms, and internal IT teams that expose system‑info dashboards.
Recommended Actions
- Upgrade to phpSysInfo 3.4.6 or later, which defaults to
REMOTE_ADDRand requires explicit trusted‑proxy configuration. - If upgrade is not immediate, add a web‑server rule that strips or validates
X‑Forwarded‑For/Client‑IPheaders before phpSysInfo processes the request. - Map the “IP allowlist enforcement” control to SOC 2 CC6, capture configuration snapshots, and schedule periodic scans to verify the fix remains effective.
Technical Notes – The bypass exploits the order of header evaluation in read_config.php. No CVSS is published yet, but the ability to disclose full system configuration places it in the High severity band. Source: Exploit‑DB 52648