CVE-2019-9053 — Unauthenticated SQL Injection in CMS Made Simple

Description

CVE-2019-9053 is a time-based blind SQL injection vulnerability affecting CMS Made Simple versions ≤ 2.2.9. It does not require authentication.

The vulnerable parameter is m1_idlist in the News module (moduleinterface.php). An attacker can exploit it to extract the administrator's password hash, username, email, and the salt used for hashing.

The password storage scheme is MD5(salt + password), where the salt is 8 bytes. This allows, once the hash and salt are obtained, to attempt offline password cracking with tools such as hashcat or John the Ripper.

CVSS 3.1: 7.5 (HIGH) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Technical Details

Exploit

Original Author

Daniele Scanu — @Certimeter Group

The original exploit is available at Exploit-DB #46635.

Requirements

• Python 2.7
• requests, termcolor

pip2 install requests termcolor

Usage

# Extract credentials (salt, user, email, password hash)
python 46635.py -u http://target/cmsms

# Extract credentials and attempt to crack the password with a wordlist
python 46635.py -u http://target/cmsms --crack -w /path/to/rockyou.txt

Parameters

How It Works

The exploit sends HTTP requests with SQL payloads containing SLEEP() to determine character by character:

1. Salt: Extracts the salt from cms_siteprefs where sitepref_name = 'sitemask'
2. Username: Extracts the username from cms_users where user_id = 1
3. Email: Extracts the email of the first admin user
4. Password hash: Extracts the hash from cms_users
5. Cracking (optional): Tests each line of the wordlist against MD5(salt + password)

Example Output

[+] Salt for password found: 5a599ef579066807
[+] Username found: jkr
[+] Email found: [email protected]
[+] Password found: 62def4866937f08cc13bab43bb14e6f7

Mitigation

• Update CMS Made Simple to version ≥ 2.2.10
• If updating is not possible, disable the News module or restrict access to moduleinterface.php

References

• NVD — CVE-2019-9053
• Exploit-DB #46635
• CVE Mitre