WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges.

published 2016-12-27 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-1228

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 67%
public exploits: 1; Exploit-DB

WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts, the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer.

Timeline

2016-12-26 First public exploit (EDB-40967)
2016-12-27 Published

Exploit prediction

1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-40967 Wampserver 3.0.6 - Insecure File Permissions Privilege Escalation local, 2016-12-26

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

Sources

CVE List CVE-2016-10031
NVD CVE-2016-10031

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary