Mime Type Injection Vulnerability in LiteSpeed Web Server
CVE-2007-5654

Currently unrated

Key Information:

Vendor

Litespeed Technologies

Status
Litespeed Web Server
Vendor
CVE Published:
23 October 2007

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 59%

What is CVE-2007-5654?

An issue has been identified in LiteSpeed Web Server prior to version 3.2.4 that enables remote attackers to manipulate MIME types through specially crafted requests. This vulnerability allows an attacker to exploit a '%00.' sequence, which can lead to unauthorized file access, including the ability to read sensitive files like PHP source code. The impact is significant as it can expose critical information that can be leveraged for further attacks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2007-5654 - Proof of Concept

References

http://www.litespeedtech.com/latest/litespeed-web-server-...
x_refsource_CONFIRM
http://secunia.com/advisories/27302
third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/37380
vdb-entryx_refsource_XF

EPSS Score

59% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.