Time to remove your phpinfo pages?

JdS · #1 08-Jun-2003, 11:12

http://www.securityfocus.com/bid/7805/info/

Quote:

Scripts that include the PHP phpinfo() debugging function may be prone to cross-site scripting attacks. This could permit remote attackers to create a malicious link to a vulnerable PHP script that includes hostile client-side script code or HTML. If this link is visited, the attacker-supplied code may be rendered in the browser of the user who visit the malicious link.

Div · #2 08-Jun-2003, 11:22

At the very least rename the file from the usual phpinfo.php. I am guessing that it won't be long before you see bots scurrying around on sites looking for that particular file name.

Allowee · #3 09-Jun-2003, 04:52

have a look at this.....

http://bugs.php.net/bug.php?id=24024

JdS · #4 09-Jun-2003, 05:08

Yep, this is why I never publicise my phpinfo to just anyone. When the need arises, better to show a static version instead.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Rate This Thread
Rate This Thread:

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Display Size and maybe download time	BobbyDouglas	MySQL / PHP Forum	5	08-Nov-2003 01:18
ambiguity in time field	zuzupus	MySQL / PHP Forum	9	28-Jul-2003 09:40
time Problem	zuzupus	MySQL / PHP Forum	9	24-Jul-2003 08:02
carry logging state across pages	skyloon	MySQL / PHP Forum	1	30-Jun-2003 06:03
The Google update this time...	JdS	Search Engine Optimization Forum	5	04-Jun-2003 16:25