CMS Made Simple <= 2.2.10 SQL Injection Exploit

Overview

This Python script exploits an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.10 (CVE-2019-9053). The exploit extracts sensitive information such as the salt, username, email, and password of the administrator from the CMS Made Simple database.

Modifications

This script is a modified version of the original exploit by Daniele Scanu. The following improvements have been made:

1. Updated to Python 3:

   • The script is now compatible with Python 3, ensuring compatibility with current and future systems.

2. Increased TIME Variable:

   • The TIME variable has been increased from 1 to 3 seconds, improving the consistency and reliability of the time-based SQL injection.

3. Enhanced Error Handling:

   • Retry logic has been added to handle request timeouts, making the script more robust and reliable.

4. Improved Code Readability:

   • The code has been cleaned up for better readability and maintenance. This includes using context managers for file operations, streamlining import statements, and formatting payload strings using f-strings.

Requirements

• Python 3.x
• requests library
• termcolor library

First, ensure you have pip installed:

apt install python3-pip

You can install the required libraries using pip:

pip install requests termcolor

Usage

1. Clone the repository:

git clone https://github.com/Dh4nuJ4/SimpleCTF-UpdatedExploit.git
cd SimpleCTF-UpdatedExploit

2. Run the exploit script:

python3 updated_46635.py -u <target_url> [-c] [-w <wordlist>]

Parameters

• -u, --url: The base URL of the target CMS Made Simple instance (e.g., http://example.com/cms).
• -c, --crack: Optional. Attempt to crack the admin password using the provided wordlist.
• -w, --wordlist: Optional. Path to the wordlist for password cracking.

Examples

Example 1: Extract information without password cracking

python3 updated_46635.py -u http://example.com/cms

Example 2: Extract information and crack the password

python3 updated_46635.py -u http://example.com/cms -c -w /path/to/wordlist.txt

Explanation

1. Extracting Salt: The script first retrieves the salt used in hashing the passwords.
2. Extracting Username: It then fetches the admin username.
3. Extracting Email: The admin email is extracted next.
4. Extracting Password: Finally, it retrieves the hashed password.
5. Cracking Password: If the -c option is provided, it attempts to crack the password using the provided wordlist.

Notes

• Ensure the target URL points to a vulnerable instance of CMS Made Simple.
• The SQL injection is time-based, so execution time may vary.
• Use responsibly and only on systems you have permission to test.

Disclaimer

This script is for educational purposes only. The author is not responsible for any misuse or damage caused by this script.