Xampp For Windows - 746 Exploit

Large enterprises are not the primary victims here. Instead, individual developers, freelancers, and small agencies are the targets.

Do not run PHP 7.4.6 in production. Even for local development, upgrade.

If you are using XAMPP as a public server (not recommended), edit the following files:

C:\xampp\apache\conf\extra\httpd-xampp.conf Find this block: xampp for windows 746 exploit

<LocationMatch "^/(?i:(?:xampp|security|licenses|phpmyadmin|webalizer|server-status|server-info))">
    Require local
    ErrorDocument 403 /error/XAMPP_FORBIDDEN.html.var
</LocationMatch>

Change Require local to Require ip 192.168.1.0/24 (your LAN) or Require ip ::1 (only localhost).

Attackers used mass-scanning tools like masscan, zmap, or Shodan.io to find Windows servers with port 80 or 443 open. They specifically looked for the X-Powered-By: PHP/7.4.6 header or the distinctive XAMPP default favicon.ico (hash: 0x38aee45f).

Search query on Shodan back in 2020:
"X-Powered-By: PHP/7.4.6" "XAMPP" Large enterprises are not the primary victims here

Never run XAMPP (or any web server) as Administrator or SYSTEM user. Create a dedicated low-privilege Windows user for Apache.

XAMPP’s default root MySQL user has no password. The installer explicitly warns about this, but users frequently click through. Combined with the phpMyAdmin bypass, this was a catastrophic combination.

The "746 exploit" works because Windows allows certain file writes. Run PowerShell as Admin: Change Require local to Require ip 192

# Remove Everyone write permission from htdocs
icacls "C:\xampp\htdocs" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /grant:r "IIS_IUSRS:(OI)(CI)RX"

Add a Windows Firewall rule to block public access to port 80/3306 unless absolutely needed.

Many developers deployed XAMPP on cloud VPS instances (AWS EC2, DigitalOcean) for quick prototyping. They assumed that "localhost only" meant the server itself – forgetting that in the cloud, localhost is still exposed to the public internet if no firewall is configured.