current community

your communities

more stack exchange communities

Stack Exchange
tour help
Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
1

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?

share|improve this question
    
Assuming your website doesn't have any command execution vulnerabilities, no. –  Chris Dec 20 '13 at 23:17

2 Answers 2

up vote 2 down vote

If Apache is properly configured with the php module loaded and correct mime types, you should expect to not have any code disclosed to the client.

Example:

AddModule mod_php.c
LoadModule php_module         modules/mod_php.so
LoadModule php5_module        modules/libphp5.so

AddType application/x-httpd-php .php

There don't seem to be any attacks against mime types in apache that would break this behavior that I know of. You should be more worried about poor coding practices, and disclosing the source code through other means such as file inclusion attack.

PHP does have a .phps extension that beautifies source code for sharing. If you use these files, make sure you strip them of any usernames and passwords before sharing them. It might be possible for a file to be incorrectly named .phps insteaf of .php -- unlikely, but possible.

share|improve this answer
    
Note: PHP doesn't need to be an Apache module, but it does need to be configured. This was just an example, so another example would be a correctly configured php-fpm install instead of an apache module. –  David Houde Dec 22 '13 at 15:30
up vote 1 down vote

Here's an example of case that how hackers use file inclusion vulnerability to disclosure PHP source code. If not not properly configured, it can even lead to remote code execution vulnerability.

PHP security exploit - list content of remote PHP file?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.