CVE-2008-6499 describes a critical vulnerability in XAMPP version 1.6.8, specifically within the security/xamppsecurity.php component. This flaw allows remote, authenticated attackers to spoof critical server variables, such as REMOTE_ADDR, by exploiting an extract operation on the SERVER superglobal array. The vulnerability carries a CVSS score of 5.5, indicating a medium severity with low attack complexity, requiring authentication, and potentially leading to partial integrity and availability impacts. While not listed on the KEV catalog or experiencing widespread community discussion, an exploit demonstrating Cross-Site Request Forgery (CSRF) to change administrative passwords is publicly available on ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6.8CPE matchmatch criteria | cpe:2.3:a:apachefriends:xampp:1.6.8:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:N/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.