CVE-2012-10062: apache_friends xampp

Vulnerability summary

CVE-2012-10062 is a high (CVSS 8.7) vulnerability in apache_friends xampp. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.2% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 30-08-2025
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits attackers to upload a malicious PHP payload and trigger its execution via a subsequent GET request, resulting in remote code execution on the server.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.