LiteServe is a powerful, full-featured Web, email and FTP server. This server software is perfect for personal websites or commercial sites with high traffic demands and multiple domains. All the services that you need work together efficiently in a single program to provide you with a feature-packed server solution that is easy to setup, manage, and monitor. A vulnerability in the product allows remote attackers to cause multiple cross site scripting vulnerabilities.
DNS Wildcard XSS
This is similar to the Apache XSS of last month. A malicious 'Host' header entity is created by a specially encoded hostname. When the hostname is rejected by the DNS server, the request is routed back to the parent:
Directory Query String XSS
The LiteServe directory indexing system fails to strip query strings from indexed folders, meaning that the URL returned by LiteServe is susceptible to cross-site scripting. URL decoding is performed before return:
