Sumeru Cyber Security
  • Sumeru Cyber Security
  • Workarounds for prevalent vulnerabilities
    • Version Disclosure
    • Host Header Attack
    • HttpOnly and Secure Flag
    • Security Headers
    • Clickjacking
    • Weak Password
    • Username Enumeration
    • jQuery Outdated
    • Cross-Origin Resource Sharing
    • AWS S3 Bucket Misconfiguration
    • Directory Listing
    • Laravel Debug Enabled
    • Autocomplete and Remember Password Enabled
    • Brute Force Attack
    • Cross Site Request Forgery
    • SQL Injection
    • PhpMyAdmin page Available Publicly
    • Implementation of BASIC Authentication
    • Cache Browsing
    • Insecure Direct Object Reference
    • Active mixed content over https
    • Improper forgot password implementation
    • ASP.NET Debug Enabled
    • Sensitive Data Sent in GET Request
    • Weak CAPTCHA Implementation
    • Csv Injection
    • Cross Site Scripting
    • Web Server Robot.txt Information Disclosure
    • SSL Related Issues
    • Local File Inclusion
    • Weak CAPTCHA Implementation
    • Automated Form Submission
    • Php.ini File Available Publicly
    • ITLP
    • Internal Path Disclosure
    • Insecure Direct Object Reference
    • Access Token Not Expiring After Logout
  • OWASP A09-Security Logging and Monitoring Failures
  • OWASP API09-Improper Inventory Management v1.0
Powered by GitBook
On this page
  • Introduction
  • How to Test
  • How to Fix
  • Reference

Was this helpful?

  1. Workarounds for prevalent vulnerabilities

Php.ini File Available Publicly

Introduction

PHP's 'ini' file is exposed inside the 'cgi-bin' directory. This allows any unauthenticated remote user to discover sensitive information about your server(s), including database logins and passwords.

How to Test

By default the php.ini file is stored in the public_html folder on your server. When you visit your domain and add /php.ini at the end of it like the following:

http://your-domaincom/php.ini

You will see the contents of your PHP configuration available over the internet.

How to Fix

To secure your php.ini settings so they are not publicly viewable, you can restrict access to the php.ini and other file types with the following code in your .htaccess.

<filesMatch ".(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">   
Order Allow,Deny   
Deny from all  
</filesMatch>

You can add more file types to the restriction by separating each file type in the code with a | and adding the file extension without the ( . )

Reference

PreviousAutomated Form SubmissionNextITLP

Last updated 5 years ago

Was this helpful?

https://www.inmotionhosting.com/support/website/restrict-public-access-php-ini/