Is there a good reason to turn off phpinfo()?

Question

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are installed, their versions, etc. But, as a developer, it's nice to know all the extensions and their versions, etc. Is phpinfo a real threat? Or is this just an overzealous precaution?

Answer 1

Typically this is done as System Administrators do not appreciate telling the whole world the versions of software that they are running. Security through obscurity isn't a valid means of protecting servers but, conversely, there's no point in telling the "bad guys" which buggy version of a piece of software you're running. They need to work for their exploits.

For authorized users, the info from phpinfo should be easily attainable from other sources.

Answer 2

It's security through obscurity.

Security through obscurity is by no means a main defense to secure your systems. Because your system has less info to show, you are a less interesting target to attackers. This doesn't mean they won't try, but they will need to try a lot harder.

Answer 3

In the past there have been exploitations which utilise the phpinfo() page, using some server globals it var_dump()'s when outputting variable info.

This information merely adds to what webtoe has to say, but it's yet another attack surface you should be weary of when you consider if your users really need phpinfo() access.

LFI WITH PHPINFO() ASSISTANCE