EgiX has reported a vulnerability in CMS Made Simple, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "templateid" parameter in modules/TinyMCE/content_css.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in version 1.2.2. Prior versions may also be affected.

Solution
Update to version 1.2.3.
Further details available to Secunia VIM customers

Provided and/or discovered by
EgiX

Changelog
Further details available to Secunia VIM customers

Original Advisory
CMS Made Simple:
http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/

http://milw0rm.com/exploits/4810

Deep Links
Links available to Secunia VIM customers