2

I surfed a popular forum in my country ordinarily, but the connection is obviously much slower.

Later the server crashed, sometimes showing "Too many connections" error, sometimes the forum.php source code was downloaded.

Isn't PHP supposed to be execute on the server machine only? I dont understand how a server crash can leak the php source code. This is a very serious security problem, how should we prevent this?

Below are some information of the server:

System: Linux VM35 3.5.5-1.el6.elrepo.x86_64 #1 SMP Thu Oct 4 15:44:44 EDT 2012 x86_64

Server API: CGI/FastCGI

Server: nginx/1.2.8

Update: The code has nothing sensitive so I am posting the php file here: forum.php

7
  • 3
    PHP source code should never contain anything sensitive anyway ;) Config files for DB passwords, abstract away DB access itself, stuff like that. Jul 3, 2014 at 10:34
  • 1
    Did you check the contents of forum.php? Was it definitely PHP source code or was it the generated HTML?
    – Jim
    Jul 3, 2014 at 10:37
  • Yes, juts wanted to ask the same question :)
    – hex494D49
    Jul 3, 2014 at 10:38
  • 2
    Do not instrument production code with debugging statements.
    – Flavius
    Jul 3, 2014 at 10:46
  • 1
    I took a look at the source. But it doesn't make any sense since there was nothing parsed within that file (at that moment). If there is a bug, it might be in some other file, loaded and parsed before this one.
    – hex494D49
    Jul 3, 2014 at 10:58

1 Answer 1

1

If you get a Too many connections error when you try to connect to the MySQL server, this means that all available connections are in use by other clients.

The number of connections permitted is controlled by the max_connections system variable. Beginning with MySQL 5.1. its default value is 151 to improve performance when MySQL is used with the Apache Web server. Set a larger value for this variable if you need to support more connections.

But this shouldn't "crash" the whole server. The PHP code doesn't have a leak issue to face this situation.

In addition, if you got PHP source code instead of HTML generated by forum.php file, than you should check your web-server's log, having in mind the time when it happened 'cause at that time it stopped parsing PHP code.

However, whenever it's possible, an application should catch these errors, warnings and notices and show back to the users in more friendly manner.

11
  • 1
    Yes, I know about the connection error. I want to understand how a server crash can leak php source code Jul 3, 2014 at 10:36
  • I wish I can check the server log to figure out the cause :( Jul 3, 2014 at 10:44
  • I see, do you have a .htaccess within that folder, does it contain something like application/x-httpd-php, or AddType ... or any other suspicious code?
    – hex494D49
    Jul 3, 2014 at 10:47
  • 1
    I dont host the forum. I just accidentally downloaded the source code Jul 3, 2014 at 10:48
  • 1
    You never know :) It may be a beginning of your hacking career :)
    – hex494D49
    Jul 3, 2014 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.