CMS Made Simple <= 2.2.9 Unauthenticated SQL Injection Exploit (Python 3)

Overview

This exploit performs an unauthenticated time-based blind SQL injection against CMS Made Simple <= 2.2.9, allowing extraction of:

• Salt used for password hashing
• Admin username
• Admin email
• Password hash

Optionally, it can crack the password using a provided wordlist.

Files

• cmsms_sqli_py3.py – Python 3 exploit script.

Requirements

• Python 3 (pre-installed on Kali)

• termcolor module:

  root@kitploit:~

  pip install termcolor
  

• Wordlist for cracking (optional), e.g., /usr/share/wordlists/rockyou.txt

Usage

Basic extraction (salt, username, email, password hash):

python3 cmsms_sqli_py3.py -u http://target-uri

Extract and crack password using a wordlist:

python3 cmsms_sqli_py3.py -u http://target-uri --crack -w /path/to/wordlist.txt

Example:

python3 cmsms_sqli_py3.py -u http://simplectf.thm/simple/ --crack -w /usr/share/wordlists/rockyou.txt

How it Works

• Performs time-based blind SQL injection on:

  root@kitploit:~

  moduleinterface.php?mact=News,m1_,default,0&m1_idlist=<payload>
  

• Extracts data character by character by checking response delays.

• Extracts:

  • Salt (cms_siteprefs table)
  • Admin username (cms_users)
  • Admin email (cms_users)
  • Admin password hash (cms_users)

• Optionally attempts to crack the extracted hash using the provided wordlist and salt.

Notes

✅ Fully Python 3 compatible (stable on TryHackMe/HTB workflows). ✅ Works within your virtual environment (venv) cleanly. ✅ Uses color output for clear tracking of progress.

Disclaimer

This exploit is for educational purposes only. Do not use it on systems you do not own or have explicit permission to test.

Credits

• Original Python 2 Exploit: Daniele Scanu @ Certimeter Group
• Python 3 Conversion and Cleanup: ChatGPT (OpenAI)

If you need automatic reporting of extracted credentials or auto-login payload generation for your pentest workflow, let me know.