Have you tried searching for "site:pastebin.com mysql_connect" ? That's even scarier. There's people that do post their database password and username publicly.
So really, yeah if you already have local access you can pwn the box, but you have pretty much done that already.