An authenticated stored cross-site scripting vulnerability in OpenLiteSpeed 1.7.9 could allow an attacker with administrative access to execute arbitrary scripts in the context of the web dashboard.

This is a stored cross-site scripting (CWE-79) vulnerability occurring within the Notes parameter of the listener configuration. An authenticated administrator can inject malicious JavaScript that executes when another user or administrator interacts with the Default Icon in the management interface.

Successful exploitation allows an attacker to execute arbitrary code within the victim's browser session, potentially leading to session hijacking, unauthorized administrative actions, or the further compromise of the web server configuration. With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of the administrative interface, which is a critical component for server management.

Immediate Action: Upgrade OpenLiteSpeed to a version beyond 1.7.9 that contains the necessary input sanitization fixes.

Proactive Monitoring: Review web server access logs for unusual POST requests directed at the /view/confMgr.php endpoint or anomalies in administrative dashboard activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious script payloads from being submitted to administrative configuration fields.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49727.

Given the availability of a public proof-of-concept and the high-privilege context of the vulnerability, administrators should prioritize updating their OpenLiteSpeed installations. While this requires administrative access to trigger, the potential for lateral movement or persistence within the management console necessitates immediate remediation to secure the server environment.