phpSysInfo 2.3 allows remote attackers to obtain sensitive information via a direct request to (1) class.OpenBSD.inc.php (2) class.NetBSD.inc.php (3) class.FreeBSD.inc.php (4) class.Darwin.inc.php (5) XPath.class.php (6) system_header.php or (7) system_footer.php which reveal the path in a PHP error message.