The exploit demonstrates two vulnerabilities in FinderView: a path traversal via base64-encoded directory traversal sequences and a reflected XSS via the callback parameter. Both are confirmed with HTTP request/response examples.
Classification
Working Poc 95%
Attack Type
Xss | Info Leak
Complexity
Trivial
Reliability
Reliable
Target:FinderView (latest commit as of 2016-06-23)
No auth needed
Prerequisites:Network access to the target application