del0x3/cve-2019-9053-port-py3CVE-2019-9053.
This is a Python 3 port of the CVE-2019-9053 exploit, which targets CMS Made Simple (CMSMS) versions before 2.2.10. The vulnerability allows for SQL injection through the News module interface.
Tested on the TryHackMe Simple CTF Challenge.
The exploit takes advantage of a SQL injection vulnerability in the CMS Made Simple News module. It can:
Download and run quickly using these commands:
# Download the exploit
curl -O https://raw.githubusercontent.com/del0x3/CVE-2019-9053-port-py3/main/exploit.py
# Download requirements
curl -O https://raw.githubusercontent.com/del0x3/CVE-2019-9053-port-py3/main/requirements.txt
# Install requirements
pip install -r requirements.txt
# Make exploit executable
chmod +x exploit.py
# Run the exploit
./exploit.py -u http://target.com/cms
Alternative using wget:
wget https://raw.githubusercontent.com/del0x3/CVE-2019-9053-port-py3/main/exploit.py
wget https://raw.githubusercontent.com/del0x3/CVE-2019-9053-port-py3/main/requirements.txt
pip install -r requirements.txt
chmod +x exploit.py
./exploit.py -u http://target.com/cms
git clone https://github.com/del0x3/CVE-2019-9053-port-py3.git
cd CVE-2019-9053-port-py3
pip install -r requirements.txt
Basic usage:
python3 exploit.py -u http://target.com/cms
With password cracking:
python3 exploit.py -u http://target.com/cms -c -w /path/to/wordlist.txt
-u, --url: Base target URL (required)-w, --wordlist: Path to wordlist for password cracking-c, --crack: Enable password cracking modeThis tool is for educational and security research purposes only. Do not use it against systems without explicit permission.
MIT License