The phpinfo() function is a useful PHP diagnostic tool, but leaving it publicly accessible creates a critical PHP security vulnerability. Recent security research focused on exposed phpinfo() pages across Australian domains reveals alarming data exposure, including leaked credentials and keys, stemming from this common misconfiguration. Understanding this phpinfo() security risk is crucial for developers and administrators.
How We Found Exposed phpinfo() Secrets
Our research methodology systematically identified these vulnerabilities:
- Domain Gathering: We compiled a list of 661,503 Australian-based domains for scanning.
- Vulnerability Scanning: We utilized tools like Nuclei to detect publicly accessible
phpinfo()pages. - Data Extraction & Analysis: A custom script (https://github.com/Guardeyean/phpinfo) was run against discovered URLs to parse the
phpinfo()output and identify leaked sensitive information.
The Alarming Scale of phpinfo() Exposure and Data Leaks
High-Level phpinfo() Security Metrics
- Domains Scanned: 661,503 (Australia)
- Exposed
phpinfo()Pages Found: 4,313 - Pages with Outdated PHP (<8.0): 2,814 (65.2%) – Increases vulnerability risk
- Pages Leaking Sensitive Data: 2,112 (49.0%) – Direct pathway to data breaches
Outdated PHP Versions Compound the Risk
A significant 65.2% of the discovered exposed phpinfo() pages were running outdated PHP versions (below 8.0). This lack of patching significantly increases the attack surface, compounding the PHP security risk. The oldest version found was PHP 5.3.10.
Pie chart showing 65.2% of exposed phpinfo pages run outdated PHP versions, highlighting a major security risk.
Sensitive Data Leaks: Credentials, Keys, and More
Nearly half (49.0%) of the exposed pages directly leaked potentially sensitive information. This demonstrates a critical failure in securing PHP environments and managing environment variables.
Pie chart illustrating that 49% of exposed phpinfo pages are leaking sensitive information, indicating a severe data exposure risk.
Types of Exposed Secrets Found via phpinfo()
Our analysis categorized over 80,000 leaked records. While server details and environment variables were common, the presence of credentials and keys poses the most immediate threat:
Bar chart detailing categories of leaked information from phpinfo pages, including database credentials, keys, and cloud credentials.
Specific (redacted) examples included leaked database credentials, WEBSITE_AUTH_ENCRYPTION_KEY, and Azure Blob Storage keys. Accessing such data simplifies website hacking attempts.
