1047
database.inc
Example Language: PHP (Bad)
<?php
$dbName = 'usersDB';
$dbPassword = 'skjdh#67nkjd3$3$';
?>
login.php
Example Language: PHP (Bad)
<?php
include('database.inc');
$db = connectToDB($dbName, $dbPassword);
$db.authenticateUser($username, $password);
?>
If the server does not have an explicit handler set for .inc files it may send the contents of
database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will
expose the database name and password.
Observed Examples
Reference Description
CVE-2002-1886 ".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2002-1886
CVE-2002-2065 ".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2002-2065
CVE-2005-2029 ".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2005-2029
CVE-2001-0330 direct request to .pl file leaves it unparsed
https://www.cve.org/CVERecord?id=CVE-2001-0330
CVE-2002-0614 .inc file
https://www.cve.org/CVERecord?id=CVE-2002-0614
CVE-2004-2353 unparsed config.conf file
https://www.cve.org/CVERecord?id=CVE-2004-2353
CVE-2007-3365 Chain: uppercase file extensions causes web server to return script source
code instead of executing the script.
https://www.cve.org/CVERecord?id=CVE-2007-3365
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Relationship
This overlaps direct requests (CWE-425), alternate path (CWE-424), permissions (CWE-275),
and sensitive file under web root (CWE-219).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unparsed Raw Web Content Delivery
CWE Version 4.14
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-434: Unrestricted Upload of File with Dangerous Type