XAMPP WebDAV PHP Upload Vulnerability Allowing Remote Code Execution

A remote code execution vulnerability exists in XAMPP version 1.7.3, specifically within its default WebDAV configuration. This vulnerability allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible at '/webdav/', accepts HTTP PUT requests using default credentials. Attackers can exploit this by uploading a malicious PHP payload and executing it through a subsequent GET request.

Impact

Exploitation of this vulnerability allows for remote code execution on the server.

Reproduction

To reproduce this vulnerability, upload a PHP payload to the WebDAV service using HTTP PUT requests. This can be done with default WebDAV credentials. After uploading, execute the payload by sending a GET request to the same location where the file was uploaded.