phpinfo() exposure: why it matters and how to fix it

What it is

The PHP manual describes phpinfo() as outputting a large amount of information about the current state of PHP, including compile options, extensions, the PHP version, server information, environment and HTTP headers. On a live site that can include database hostnames, API keys stored in environment variables and internal paths. MITRE classifies the result as CWE-200, exposure of sensitive information.

How to detect it

• Search the web root for files that call phpinfo( and for names such as info.php, phpinfo.php and test.php.
• Request those names on sites you own and check for a 200 response. Do not scan sites you do not own.
• Check whether the X-Powered-By header shows the PHP version; that is controlled by expose_php.

How to fix it

• Delete phpinfo files from production. If you need the information, run php -i on the server or protect a temporary page behind authentication and remove it afterwards.
• Add phpinfo to disable_functions in php.ini if no application needs it.
• Set expose_php = Off to remove the version from response headers.
• Rotate any secret that appeared on an exposed phpinfo page, because you cannot know who saw it.

Read-only checks and safe patterns

# Find leftover phpinfo() files (read-only)
grep -rln "phpinfo\s*(" --include=*.php /var/www 2>/dev/null | grep -v /vendor/

# Check your own site for common file names (only on hosts you own)
for f in phpinfo.php info.php test.php i.php; do
  curl -s -o /dev/null -w "%{http_code} $f\n" "https://your-site.example/$f"
done

; php.ini: stop advertising the version and block the function
expose_php = Off
disable_functions = phpinfo

Other PHP vulnerability classes

• PHP object injection: what it is and how to fix itPHP object injection happens when user-controlled input reaches unserialize(), which can instantiate objects whose magic methods run attacker-chosen logic.
• PHP file inclusion (LFI/RFI): what it is and how to fix itFile inclusion happens when user input controls the path passed to include or require, letting an attacker read local files (LFI) or, with allow_url_include on, run remote code (RFI).
• SSRF in PHP: what it is and how to fix itServer-side request forgery (SSRF) happens when a PHP app fetches a URL the user controls, letting an attacker reach internal services or cloud metadata endpoints through your server.
• XSS in PHP: what it is and how to prevent itCross-site scripting (XSS) happens when a PHP page outputs user-controlled data into HTML without escaping, so an attacker’s script runs in other visitors’ browsers.