| Description: | | MySQL configuration files routinely hold connection strings, plaintext credentials, host ports, character sets, and paths to SSL/TLS keys. When acquired through web path traversal, directory brute-forcing, or backup-file scanning, these files expose database credentials that allow an attacker to pivot to the database tier, exfiltrate, tamper with, or ransom business data. Additional entries such as backup directories, log locations, and plugin folders can be leveraged for privilege escalation, backdoor installation, or constructing deeper persistence, placing the entire data estate at risk of compromise. |