1375
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: Architecture and Design
Phase: System Configuration
Recommendations include removing this script from the web server and moving it to a location
not accessible from the Internet.
Demonstrative Examples
Example 1:
The following code uses an include file to store database credentials:
database.inc
Example Language: PHP (Bad)
<?php
$dbName = 'usersDB';
$dbPassword = 'skjdh#67nkjd3$3$';
?>
login.php
Example Language: PHP (Bad)
<?php
include('database.inc');
CWE Version 4.14
CWE-541: Inclusion of Sensitive Information in an Include File
CWE-541: Inclusion of Sensitive Information in an Include File