PHPinfo pages
Description
One or more publicly accessible pages containing the phpinfo() function were discovered on the web server. The phpinfo() function is a diagnostic tool that outputs comprehensive system information including PHP version and configuration, installed extensions and modules, server software details, operating system information, environment variables, file paths, database connection settings, and HTTP headers. While useful for development and debugging, this information should never be exposed in production environments.
Remediation
Immediately remove all phpinfo() pages from production environments by taking the following actions:
1. Delete the entire file if it serves no purpose:
rm /path/to/phpinfo.php2. If the file must remain, remove or comment out the phpinfo() function call:
<?php // phpinfo(); // Removed for security ?>3. Alternatively, restrict access using web server configuration:
For Apache (.htaccess or virtualhost configuration):
<Files "phpinfo.php">
Require all denied
</Files>For Nginx (server block configuration):location ~* phpinfo\.php$ {
deny all;
return 404;
}4. Verify removal by attempting to access previously identified URLs5. Scan the entire web root for other diagnostic files:
find /var/www -name "*info*.php" -o -name "test*.php"For development and testing purposes, use phpinfo() only in local environments that are not accessible from the internet.