Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are installed, their versions, etc. But, as a developer, it's nice to know all the extensions and their versions, etc. Is phpinfo a real threat? Or is this just an overzealous precaution?

share|improve this question
2  
You're on an IT Security site. The question should be: Is there a really good reason to leave phpinfo() on? –  Iszi Mar 6 '12 at 21:57
add comment

3 Answers

Typically this is done as System Administrators do not appreciate telling the whole world the versions of software that they are running. Security through obscurity isn't a valid means of protecting servers but, conversely, there's no point in telling the "bad guys" which buggy version of a piece of software you're running. They need to work for their exploits.

For authorized users, the info from phpinfo should be easily attainable from other sources.

share|improve this answer
add comment

It's security through obscurity.

Security through obscurity is by no means a main defense to secure your systems. Because your system has less info to show, you are a less interesting target to attackers. This doesn't mean they won't try, but they will need to try a lot harder.

share|improve this answer
add comment

In the past there have been exploitations which utilise the phpinfo() page, using some server globals it var_dump()'s when outputting variable info.

This information merely adds to what webtoe has to say, but it's yet another attack surface you should be weary of when you consider if your users really need phpinfo() access.

LFI WITH PHPINFO() ASSISTANCE

share|improve this answer
1  
It's also trivial to inject javascript into the output and therefore XSS attacks. –  symcbean Mar 7 '12 at 12:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.