It is possible to retrieve the source code from server side script and also may possible to expose the business logic or sensitive information such as username and password.
Possible Causes
· Patches for 3rd. party products were not installed
· Temporary files were left in production environment
· Debugging information was left by the programmer in web pages
Application source code should not be accessible to web users, as it may contain sensitive application information and back-end logic.
It can give an attacker useful guidance for future exploitation. Leakage of sensitive information may carry various levels of risk and should be limited whenever possible.
Recommendation
There are many ways to revealing application source code. To ensure that your application does not allow web users access to source code. [1] Check that all system patches related to source code disclosure are installed. [2] Check that no application source code is left in HTML comments. [3] Check that all source code files are removed from the production environment