CMS-Made-Simple-2.2.9 - SQL-Injection-Exploit - CVE-2019-9053

Description

This repository contains an exploit for an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. This vulnerability, identified under CVE-2019-9053, allows an attacker to retrieve sensitive information such as the username, hashed password, email, and salt of the CMS administrator.

The original script was written by Daniele Scanu from Certimeter Group and has been updated by Azrenom to be compatible with Python 3 and to include several optimizations for error handling and overall stability.

Features

• Extraction of salt, username, email, and hashed password of the CMS administrator.
• Ability to crack the administrator's password using a wordlist through brute force.
• Compatible with Python 3.
• Handles encoding errors when reading wordlists.

Requirements

• Python 3.x
• Python libraries:
  • requests
  • termcolor

Installing Dependencies

Before running the script, install the required dependencies using pip:

pip install requests termcolor

Usage

1. Exploiting without password cracking

To run the exploit and retrieve information about the CMS administrator without attempting to crack the password:

python3 exploit.py -u http://[TARGET-IP]/cms

Replace `[TARGET-IP]` with the actual IP address or URL where CMS Made Simple is hosted.

2. Exploiting with password cracking

If you have a wordlist and want to attempt cracking the administrator's password after retrieving the salt and hashed password:

python3 exploit.py -u http://[TARGET-IP]/cms --crack -w /usr/share/wordlist/dirb/big.txt

Available Options

How the script works

The script operates in several stages:

1. Salt extraction: Using an SQL injection, the script retrieves the salt used to hash the administrator's password.
2. Retrieving credentials: The script retrieves the administrator's username, email, and hashed password.
3. Password cracking: If the `--crack` option is enabled, the script attempts to crack the password using a wordlist.
4. Results display: The extracted information is printed in the terminal.

Limitations

• This attack is based on a time-based SQL injection; thus, depending on the server configuration, it may take more time.
• The password cracking functionality relies on a wordlist. Without an adequate wordlist, cracking the password may not be successful.

Disclaimer

This script is provided for educational and research purposes only. Any use against systems without explicit permission from the owner is illegal. Use it only in controlled environments or with proper authorization.

---

Contributing

If you'd like to contribute to this project, you can:

1. Fork the repository.
2. Create a branch for your changes.
3. Submit a pull request with a clear description of the changes.