Description

Detects usage of phpinfo() function calls that can expose sensitive system and configuration information. When present in production code, phpinfo() can leak technical details about the PHP environment, server configuration, and system paths that could be exploited by attackers.

Detection Strategy

• Searches for direct calls to the phpinfo() function in PHP code

• Reports a vulnerability when phpinfo() is found in any context or scope

• Each occurrence of phpinfo() is flagged as a separate vulnerability due to information disclosure risk

Vulnerable code example

<?php
phpinfo(); // Dangerous: Exposes sensitive server configuration information
?>

✅ Secure code example

<?php
declare(strict_types=1);

// Return minimal response instead of exposing server details
header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');

echo json_encode(['status' => 'ok']);