CMS Made Simple Forums

Just came across this on Bugtraq:

cmsmadesimple Multiple Security Issues : XSS+ LFI
http://seclists.org/bugtraq/2010/Feb/133

I tried the proof of concept code on my own non-public 1.6.6 installation but couldn't get it to work.  Maybe it only works on a default installation or it's configuration dependent.  I didn't want to file a bug until it can be reproduced.  Can anyone with more in-depth CMSMS knowledge check this out and see if these are real vulnerabilities?

It's been dealt with, we're waiting for confirmation from the original hacker that the bug is fixed, and then 1.6.7 will be released,.

Great.  Nice to hear it's been so quickly dealt with.

What was exploiting this vulnerability supposed to be able to do?

We found where the concern came from, but we honestly could not replicate the issue. However, we made a change to be proactive. Once we hear back the confirmation a 1.6.7 will go out.