CMS Made Simple can have its install functionality leveraged to insert a malicious SQL statement that allows for command execution pass through.