PHP Config contain database IDs and passwords

The PHP configuration file is used for running applications that require PHP. The major use of this file is to configure the properties of the variable. This includes upload size, file timeouts, resource limits etc. The PHP file might include Database ids and password details. An attacker with an average idea on the working of the credentials can exploit the vulnerability and he will be able to communicate directly with the database.

Example

The following is a sample code present in a PHP configuration file.

    ; PHP_MEMORY_LIMIT is taken from environment
    memory_limit = ${PHP_MEMORY_LIMIT}

    

Impact

Using this vulnerability, an attacker can:-

• gain full access to the server.
• perform a data breach for gathering sensitive information.
• Read, update and delete any data/tables from the database.
• Execute commands on the underlying operating system.

Mitigation / Precaution

Beagle recommends the following impacts:-

• Restrict access to this file or restrict the disclosure
  • This can be done by creating a new file named configuration file with unix permission set to 644.

        define (DB_USER, "mysql_user");
        define (DB_PASSWORD, "mysql_password");
        define (DB_DATABASE, "database_name");
        define (DB_HOST, "localhost");
        ?>

    

• The following will be the change in the main PHP file.

    require ("configuration.php");
    public class DatabaseConnect
    {
    function __construct()
    {
        mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die('Could not connect to MySQL server.');
        mysql_select_db(DB_DATABASE);
    }
    
    }
    

Written by

Sooraj V Nair

Cyber Security Engineer