A critical vulnerability in ProxySQL, a MySQL/PostgreSQL proxy, allows remote attackers to spoof client IP addresses via malformed PROXY protocol v1 headers. Versions 2.0.0 through 3.0.8 incorrectly parse `PROXY UNKNOWN` frames by processing address fields despite HAProxy's specification requiring these to be ignored. This enables attackers to inject arbitrary source/destination addresses into the `addr.addr` session field, bypassing IP-based access controls and logging mechanisms. The CVSS 10.0 score reflects the high risk of unauthorized access, data exfiltration, and evasion of network security monitoring. All users of affected ProxySQL versions are advised to upgrade to 3.0.9 or later immediately. Mitigation includes applying official patches and validating PROXY protocol implementations in load balancer configurations. This issue underscores the importance of strict protocol validation in proxy services handling untrusted traffic.