CMS Made Simple Forums

Thanks for the info. I should've read the documentation more thoroughly. I guess that effectively solves the issue.

One of our clients found this in their internal testing. The problem is that many site-altering functionalities, like posting news items, in the admin interface are operated through regular HTTP GETs, rather than e.g. POSTs authenticated in some way. For example, if an attacker finds out that exampl...