php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #20750 Serious security hole when accessing phpinfo() in a .htaccess protected dir.
Submitted: 2002-12-01 13:37 UTC Modified: 2002-12-02 02:31 UTC
From: kapp at bigping dot de Assigned:
Status: Not a bug Package: Apache related
PHP Version: 4.2.3 OS: all
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2002-12-01 13:37 UTC] kapp at bigping dot de 
On all Servers we administrate, we always install an 'info.php' file which only contains the phpinfo() function.

Now I found that PHP returns the transmitted password in clear text to the browser. The page is stored in the browsers cache or someone could just have a look on my screen. :-((

I think this is a serious security hole.
The password should not be returned to the browser in any way, best would be to show some asterisks ('*******'), to show that the variable exists.

Ulrich Kapp

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-12-02 02:31 UTC] sesser@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

If you do not want that your users can see this information then do not give them the ability to view phpinfo().
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Apr 20 14:01:29 2024 UTC