Hey, so i decided to open this blog with with a post about a vulnerability I?ve found quite some time ago in LiteSpeed HTTP server Basically a simple reflected XSS(Cross Site Scripting) in the administrator panel which is another instance of the HTTP server running on port 7080 If an attacker succeed in convincing an administrator with an active session to enter a maliciously crafted link using this vulnerability an attacker may perform malicious act such as creating a new user with administrator privileges or in other words ? Pwnage. To reproduce: http://lightspeed-server:7080/service/graph_html.php?gtitle=VHOSTa%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 14/3/2012 ? Vendor was notified anyway nothing too technical/interesting for now.