Description
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LiteSpeed Technologies | LiteSpeed Web Server Enterprise | 5.4.11 | — |
References
- ExploitDB-49523 exploit
- LiteSpeed Technologies Official Homepage product
- LiteSpeed Web Server Product Page product
- VulnCheck Advisory: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection third-party-advisory