Multiple Vulnerabilities in Eleanor CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Eleanor CMS which could be exploited to perform cross-site scripting and SQL injection attacks.

1) Cross-site scripting (XSS) vulnerability in Eleanor CMS
The vulnerability exists due to input sanitation error in the "whereform" parameter in admin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
POST /admin.php HTTP/1.1
user_name=111&pass=222&whereform="><script>alert("XSS");</script>& submit=%C2%EE%E9%F2%E8

2) SQL injection vulnerability in Eleanor CMS
The vulnerability exists due to input sanitation error in the "module" parameter in download.php and upload.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://[host]/download.php?module=1%27
http://[host]/upload.php?module=1%27