Should this be of concern?

[Virtuous101]

Hi

I've just stumbled across this apparant vulnerability. Should this be of concern?

Thank you...

-------- [edit] -------------

Sorry... not sure why it got posted in this topic!

[Zorchenhimer]

Personally speaking, I wouldn't worry about it. On the off chance that you site is attacked in such a way, you have a bigger problem to deal with. NanoCMS is a single user content management system, so someone has to figure out your admin login credentials in order to exploit this vulnerability.

Besides, if you really wanted to, you could put malicious code directly in the body of a page instead of just the title. Neither one of those fields are sanitised (unless TinyMCE does some sanitising). But if you feel really concerned about this, I could probably whip up a patch for you.

Edit: As for the pagesdata.txt vulnerability also mentioned in the link you provided, there is a fix: http://www.nanocms.co.uk/forum/thread-40.html
(from what I understand, this fix is already in the community build).

[Andrew]

Cheers for your feedback Zorchenhimer. Much appreciated.

[Virtuous101]

Thanks for the response.. =)

I've looked into many CMS's, and to be honest, I haven't found one yet without a vulnerability of some kind! =)

I'm new to php, and currently studying it, but I have a huge interest in nanocms!