The PHP configuration file is used for running applications that require PHP. The major use of this file is to configure the properties of the variable. This includes upload size, file timeouts, resource limits etc. The PHP file might include Database ids and password details. An attacker with an average idea on the working of the credentials can exploit the vulnerability and he will be able to communicate directly with the database.
The following is a sample code present in a PHP configuration file.
Using this vulnerability, an attacker can:-
gain full access to the server.
perform a data breach for gathering sensitive information.
Read, update and delete any data/tables from the database.
Execute commands on the underlying operating system.
Mitigation / Precaution
Beagle recommends the following impacts:-
Restrict access to this file or restrict the disclosure
This can be done by creating a new file named configuration file with unix permission set to 644.
The following will be the change in the main PHP file.
Beagle Security helps you to proactively secure your web apps & APIs
with automated penetration testing & actionable remediation insights.