phpinfo is like a very in-depth system info function for php. Its a debugging function, and shouldn't be in production code to begin with.

The issue i see being exploited is that the owncloud codebase contains this function, and its in the unit/integration tests, which shouldnt be in production code (or should be inaccessible at least).

That all being said, the real issue here is that there are sysadmins and devops people who are deploying php.ini configurations to production that allow the use of phpinfo (and probably other functions too), by not explicitly denying those functions, which is totally something the php configuration supports, and is absolutely something that should be done, as there are a number of unsafe php functions.

https://www.php.net/manual/en/ini.core.php#ini.disable-funct...