Possible Source Code Disclosure (PHP)

Description

During the scan, Kayran managed to find a Possible Source Code Disclosure (PHP) vulnerability.
An attacker could obtain the source code on the server-side of the web application, which may contain highly sensitive data – such as database connection, credentials – along with the logic behind the code and the business logic of the application.

The attacker might abuse this vulnerability to collect sensitive information about the system.
An attacker can use this information to perform more advanced attacks later on.

By obtaining the source code, the attacker will be able to deeply understand the logic of the web application, how the application handles requests and their parameters, vulnerabilities in the code and source code comments.

Recommendation

To prevent the Possible Source Code Disclosure (PHP) vulnerability, implement access control and access to non-public files, ensure that no code is left in the comments. If possible, it’s better to remove these files.

References

https://cwe.mitre.org/data/definitions/200.html

< Return to all Vulnerabilities

The Dark Web

Let’s talk about the darker and more mysterious side of the internet, also known as The Dark Web. You’ve probably heard about it, whether it’s

Read More »

Exposing the GIT

Let’s start with defining the meaning of GIT. GIT – is an open-source system which we use as a tool to store data and information

Read More »

Passwords 101

Unlike basketballs, “passwords” are things we don’t want to be passed around, especially in a society built around the idea that “mystery” is appealing. We

Read More »