What security problems could come from exposing phpinfo() to end users?

后端 未结 6 1518
滥情空心
滥情空心 2020-12-01 10:27

If a phpinfo() dump is shown to an end user, what is the worst that a malicious user could do with that information? What fields are most unsecure? That is, if

6条回答
  •  星月不相逢
    2020-12-01 10:48

    Knowing the structure of your filesystem might allow hackers to execute directory traversal attacks if your site is vulnerable to them.

    I think exposing phpinfo() on its own isn't necessarily a risk, but in combination with another vulnerability could lead to your site becoming compromised.

    Obviously, the less specific info hackers have about your system, the better. Disabling phpinfo() won't make your site secure, but will make it slightly more difficult for them.

提交回复
热议问题