This advisory details multiple vulnerabilities in ZeewaysCMS, including a directory traversal (LFI) via the 'targeturl' parameter and stored XSS in profile fields. It provides proof-of-concept URLs and payloads but lacks functional exploit code.
Classification
Writeup 90%
Attack Type
Xss | Info Leak
Complexity
Trivial
Reliability
Reliable
Target:ZeewaysCMS (version unknown)
No auth needed
Prerequisites:Access to the target URL · Ability to send crafted GET/POST requests