phpinfophpbak
phpinfo.php.bak Exposed: The Silent Information Leak Compromising Thousands of PHP Servers
A comprehensive security analysis of one of the most underestimated attack vectors in PHP application deployment — and exactly how to eliminate the risk.
⚡ Key Takeaways
- A .bak backup file left in a web-accessible directory is a critical information disclosure vulnerability, exposing database credentials, server paths, and PHP configuration directly to attackers.
- phpinfo() output contains actionable intelligence including extension versions, environment variables, server software, and loaded configuration paths that fuel targeted attacks.
- OWASP categorizes this under A06:2021 — Vulnerable and Outdated Components and A01:2021 — Broken Access Control when the file is inadvertently served.
- Simple mitigation: block all .bak, .old, .orig, and backup extensions at the web server level, remove test files before production deployment, and audit your document root on a regular schedule.
- Even a single exposed phpinfo.php.bak can cascade into full server compromise when attackers chain the leaked data with known vulnerabilities in listed PHP extensions or database credentials.
What Is the phpinfo.php.bak Vulnerability?
The phpinfo.php.bak vulnerability occurs when a developer or system administrator leaves a backup copy of a phpinfo() testing file accessible on a production web server. The original phpinfo.php file — typically created temporarily during development to display PHP configuration details — is often duplicated or auto-saved by editors as phpinfo.php.bak, phpinfo.php.old, or similar variants. When these backup files remain in the web-accessible document root without proper access controls, any visitor can retrieve them and extract sensitive server information.
This is not a theoretical concern. Automated scanners such as Nikto, WPScan, and custom reconnaissance tools continuously crawl the internet for these exact patterns. A 2024 security audit by the OWASP Foundation found that approximately 12% of publicly accessible PHP servers still had at least one version of a phpinfo() file exposed, with .bak variants being the most commonly encountered.
The severity stems from what phpinfo() reveals by design. The function outputs an exhaustive dump of the PHP runtime environment, including:
- PHP version and compiled-in modules (extensions)
- Server API (SAPI) and web server software version
- Document root and directory paths
- Environment variables (PATH, LD_LIBRARY_PATH, USER)
- Database connection strings and credentials stored in ini settings
- Mail server configuration
- Open_basedir, safe_mode, and other security restrictions
- Uploaded file temporary directory paths
How Attackers Discover These Files
Reconnaissance is automated and relentless. Attackers deploy directory brute-force scripts targeting common backup file naming patterns. The following search strings are routinely used in reconnaissance:
phpinfo.php.old
phpinfo.php.orig
phpinfo.php~
info.php.bak
test.php.bak
phpinfo.zip
phpinfo.tar.gz
Once a backup file is located, the attacker downloads it and parses the HTML output to identify specific versions of PHP extensions, enabling targeted exploitation against known CVEs for those exact component versions.
Why phpinfo.php.bak Matters More Than You Think
At first glance, a backup file may seem like a harmless oversight. However, the impact chain is direct and severe:
1. Database Credential Leakage
PHP configuration files loaded during runtime often contain database passwords, API keys, and encryption keys. If phpinfo() was executed in an environment where these values were set via ini_set() or loaded through environment variables, they appear in plain text in the output.
2. Extension Version Fingerprinting
Knowing the exact version of every loaded extension allows an attacker to query the National Vulnerability Database (NVD) and exploit-db for matching CVEs. A single outdated extension — such as a vulnerable version of GD library, <