CVE-2026-55584: phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo’s PSI_ALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in read_config.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTE_ADDR. An attacker can send X-Forwarded-For: <an allowed IP> to impersonate a trusted address and gain full access to all exposed system information, defeating the only IP-based access restriction the application provides.