Effectively you do not ever want administrative consoles, administrative applications, or insecure applications exposed to untrusted networks such as the Internet.
It is possible to run these web-apps on other internal ports or simply ports that are not accessible to the outside world or other untrusted networks, then access the web-apps via a VPN. This would allow you to VPN to your server to do web-based configuration tasks and/or use the untrusted apps without exposing them to the Internet or untrusted networks.
The concern is that in some cases when you add such web-based administration tools these can be exposed to both the external (untrusted) and internal (trusted) networks at the same time, especially if it's via the same server daemon. So you will want to do a test to confirm this is not the case.
Alternatively, what some people do is run two different webservers on the same system (For example you could run IIS for external apps on ports 80 and 443, then run Apache with another app on a high port such as 32443 which is either blocked by a firewall or run on an internal loopback address such as 127.0.0.1. There are many ways to do this.
Back to your question of relative risk. The system with more code/applications accessible to the untrusted networks will be at greater risk from the untrusted networks. If you are comparing two applications side by side it will be a relative comparison at a given point in time taking into account the security controls in place for each application at it's most current version level.
In a direct comparison of the following two:
1.) ISS + PHP + phpMyAdmin
2.) ISS + PHP + phpMyAdmin + XAMPP
One would expect the second combination to be likely to have more vulnerabilities at a given point in time because it effectively exposes more attack surface. There are exceptions where added software adds additional security controls but in general this is an easy way to look at your exposed attack surface.
Note: There are many other ways to solve the problem you are trying to solve. You could also look at using tools like mod_security and the use of static IP's with firewall configurations too.
Finally, I have to point out that no matter which way you go you will want to do a lot more to secure this system if it is exposed to the Internet.