Removing the secret

Take the password out of the file

The immediate fix is to remove the plaintext secret from the file. Here you delete the line that holds the password:

sudo sed -i '/DB_PASS/d' /var/www/app/config.php
cat /var/www/app/config.php

In the terminal (the password line is gone from the config)

student@vulntech:~$ sudo sed -i '/DB_PASS/d' /var/www/app/config.php
[sudo] password for student:
student@vulntech:~$ cat /var/www/app/config.php
<?php
// Database connection settings
$DB_USER = 'root';
$DB_NAME = 'appdb';

Removing it from the file is only half the job in the real world. Because the secret was exposed, you must also rotate it (change it everywhere it was used) and keep the new one in a protected secrets store or an environment variable the file reads at run time — never hard-coded, and never reused across accounts.