CVE-2019-8923

CRITICAL

XAMPP <= 5.6.8 - SQL Injection via cds-fpdf.php jahr Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-8923. PoCs published by Rafael Pedrero.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in XAMPP 5.6.8 and earlier versions via the 'interpret' or 'titel' parameters in cds-fpdf.php. The PoC shows how unfiltered input can lead to arbitrary JavaScript execution.

Description

XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued.

Exploits (1)

exploitdb WORKING POC

by Rafael Pedrero · htmlwebappsphp

https://www.exploit-db.com/exploits/46424

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in XAMPP 5.6.8 and earlier versions via the 'interpret' or 'titel' parameters in cds-fpdf.php. The PoC shows how unfiltered input can lead to arbitrary JavaScript execution.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: XAMPP 5.6.8 (and previous)

No auth needed

Prerequisites: XAMPP 5.6.8 or earlier installed and accessible

MITRE ATT&CK