how much % of these 1% websites have their database server allowing remote connections ?
does the DB password mean anything without allowing remote connections ? (let's forget shared hosts for a moment)
does the DB password mean anything without allowing remote connections ? (let's forget shared hosts for a moment)
But...
It is rare there is only one app on a server, even a non-shared one, so this information could be used in conjunction with this information in order to cause bother. It is not uncommon to see something like phpMyAdmin installed in a standard location on a given domain and not locked down well - for sites where this is the case this bug is very serious.
It is scary how many people out there calling themselves sysadmins use the same password for everything to do with a given service, or even for everything - for them this is a bigger problem as revealing the DB password also reveals the credentials needed to access other things (perhaps an SSH account with privileged access either directly or via sudo).
That should immediately mark them as a Dunning-Krueger victim/hack and you should get someone else. If you're not using something equivalent to a password vault or something equivalent, you're not as security savvy as you think you are.
That depends on the contents of the file in question. Example: An attacker can forge hmacs if the config file contains the signing key.