pasan2002/cve-2019-9053---cms-made-simple-sql-injection-exploit-modified-This is a modified version of the time-based SQL injection exploit for CMS Made Simple <= 2.2.9. The exploit was originally created by Daniele Scanu and has been updated for better compatibility and modern Python practices.
This is a modified version of the time-based SQL injection exploit for CMS Made Simple <= 2.2.9. The exploit was originally created by Daniele Scanu and has been updated for better compatibility and modern Python practices.
This version includes the following improvements:
Removed termcolor dependency - The original script required the termcolor library for colored output. This version removes that dependency, making it work out of the box with standard Python installations.
Modernized file handling - Replaced old-style file operations with context managers (with statements) for safer and more Pythonic code.
Added error handling - Implemented try-except blocks to handle missing wordlist files gracefully.
Code simplification - Cleaned up global variable declarations and improved code readability.
python exploit.py -u http://target-uri
python exploit.py -u http://target-uri --crack -w /path/to/wordlist.txt
requests libraryInstall requirements:
pip install requests
This exploit uses time-based blind SQL injection to extract:
Optionally, it can crack the password using a provided wordlist.
⚠️ For Educational Purposes Only
This tool is provided for educational purposes and authorized penetration testing only. Used for TryHackMe CTF practice. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.
This is a modification of a publicly available exploit. Use responsibly and ethically.