CVE-2008-6499: Apachefriends Xampp

Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days.

security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to spoof critical variables, as demonstrated by setting the REMOTE_ADDR variable to 127.0.0.1.

Affected products

• Apachefriends Xampp: version 1.6.8 only

Published 2009-03-20. Last modified 2026-06-16.