CVE-2020-11107

Classification basis

The artifact contains a PowerShell script (50337.ps1) that actively modifies a system configuration file to replace a legitimate executable path with a malicious one, which is the core exploit action. The README.md provides a complete exploitation chain from payload generation to reverse shell capture, confirming the artifact's purpose is to exercise the vulnerability, not merely detect it.

Requirements

• Low-privilege local access to a Windows system running a vulnerable XAMPP version (< 7.2.29, 7.3.x < 7.3.16, 7.4.x < 7.4.4).README.md:5-8
• Ability to write to C:\xampp\xampp-control.ini.README.md:28
• A malicious executable (e.g., msf.exe) placed at a known path on the target.README.md:65-80

Observed behavior

• Reads the third line of xampp-control.ini and extracts the current editor path.50337.ps1:10-11
• Replaces the extracted editor path with a hardcoded malicious executable path (payload withheld) in xampp-control.ini.50337.ps1:13-14
• When an administrator opens a log via the XAMPP Control Panel, the malicious executable runs with the administrator's privileges.README.md:7-8

Observables

File Modification

Payload withheldThis is the core of the PoC: it swaps the editor executable path to achieve privilege escalation when an admin opens a log.50337.ps1:10-14

Payload Path

Payload withheldThe README instructs the user to generate and place a malicious executable at this path. The script itself does not create or fetch the payload.README.md:67-71README.md:77-80