Design/Logic Flaw

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...