vendor:
XAMPP
by:
retrogod
7.5
CVSS
HIGH
Buffer Overflow
120
CWE
Product Name: XAMPP
Affected Version From: XAMPP for Windows version 1.6.0a
Affected Version To: XAMPP for Windows version 1.6.0a
Patch Exists: NO
Related CWE: Not specified
CPE: a:apache_friends:xampp:1.6.0a
Platforms Tested: Windows
Not specified
XAMPP for Windows <= 1.6.0a adodb.php/mssql_connect() remote buffer overflow
This is a proof-of-concept exploit for a remote buffer overflow vulnerability in XAMPP for Windows version 1.6.0a. The vulnerability exists in the adodb.php file, specifically in the mssql_connect() function. By exploiting this vulnerability, an attacker can overwrite the structured exception handler (SEH) and gain control over the affected system. The exploit targets Windows 2000 SP3 version. This exploit was developed by retrogod and can be found on their website at http://retrogod.altervista.org.
Mitigation:
Update XAMPP for Windows to a version higher than 1.6.0a. Avoid exposing XAMPP installations to the public internet.