Description
During the scan, Kayran managed to find a Possible Source Code Disclosure (PHP) vulnerability.
An attacker could obtain the source code on the server-side of the web application, which may contain highly sensitive data – such as database connection, credentials – along with the logic behind the code and the business logic of the application.
The attacker might abuse this vulnerability to collect sensitive information about the system.
An attacker can use this information to perform more advanced attacks later on.
By obtaining the source code, the attacker will be able to deeply understand the logic of the web application, how the application handles requests and their parameters, vulnerabilities in the code and source code comments.
Recommendation
To prevent the Possible Source Code Disclosure (PHP) vulnerability, implement access control and access to non-public files, ensure that no code is left in the comments. If possible, it’s better to remove these files.
