hf3cyber/cms-made-simple-2.2.9-unauthenticated-sql-injection-exploit-cve-2019-9053-Time-based blind SQL injection exploit for CMS Made Simple <= 2.2.9 (CVE-2019-9053) that extracts username, email, password hash, and salt, with optional password cracking via wordlist.
📌 Description
This exploit targets an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.9 (CVE-2019-9053). The vulnerability allows attackers to extract sensitive information such as username, email, password hash, and salt via a time-based blind SQL injection.
Additionally, the exploit supports password cracking using a provided wordlist.
Unauthenticated SQL Injection
Extracts Username, Email, and Password Hash
Retrieves Password Salt
Supports Password Cracking via Wordlist (Optional)
Uses Time-Based Blind SQL Injection
Clone the repository:
git clone https://github.com/hf3cyber/CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-.git
cd CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-
Basic Exploitation
python3 exploit.py -u http://target.com/cms
Exploitation with Password Cracking
python3 exploit.py -u http://target.com/cms -c -w /usr/share/wordlist/rockyou.txt
Python 3
requests module (pip install requests)
termcolor module (pip install termcolor)
To protect against this vulnerability, upgrade CMS Made Simple to the latest secure version and ensure proper input sanitization with prepared statements.
This exploit is for educational and authorized penetration testing purposes only. Misuse of this script for unauthorized access is illegal. The author is not responsible for any misuse or damage caused.
This project is licensed under the MIT License. See the 
🤝 Contributing
Contributions are welcome! Feel free to open an issue or submit a pull request to improve the script.