CVE-2019-9053 Exploit - CMS Made Simple Unauthenticated SQL Injection (SQLi)

An exploit script for CVE-2019-9053, a critical unauthenticated SQL injection (SQLi) vulnerability in CMS Made Simple versions 2.2.9 and below. This tool leverages time-based SQL injection to extract admin credentials (username, email, password hash, and salt) from vulnerable CMS Made Simple sites. It also offers optional password cracking using a wordlist, targeting this security flaw that allows attackers to retrieve sensitive data without authentication. Exploitation of CVE-2019-9053 can lead to full site takeover, data breaches, or malicious code injection, making it a significant risk for unpatched systems.

Author

• so1icitx

Features

• Tests CMS Made Simple for CVE-2019-9053 vulnerability with a time-based SQLi check.
• Extracts admin credentials: salt, username, email, and password hash.
• Optional password cracking with a wordlist to recover plaintext passwords.
• Colorized output for easy monitoring of SQL injection progress.
• Debug mode displaying request URLs and response times for vulnerability exploitation.

Prerequisites

• Python 3.6+
• Required packages:
  root@kitploit:~

  pip install requests termcolor
  

Usage

python3 exploit.py -u <target_url> [options]

Options

• -u, --url: Base URL of the CMS Made Simple instance (e.g., http://example.com) - required.
• -w, --wordlist: Path to a wordlist file or directory for password cracking (optional).
• -c, --crack: Enable password cracking mode (optional).
• -t, --time: Sleep time in seconds for time-based SQL injection (default: 5).

Examples

• Basic SQLi exploit:
  root@kitploit:~

  python3 exploit.py -u http://10.10.171.64/simple
  

• With password cracking:
  root@kitploit:~

  python3 exploit.py -u http://10.10.171.64/simple -c -w /path/to/rockyou.txt
  

• Custom sleep time for time-based SQLi:
  root@kitploit:~

  python3 exploit.py -u http://10.10.171.64/simple -t 10
  

Notes

• Targets must run CMS Made Simple 2.2.9 or below with the News module enabled.
• Exploits a flaw in /moduleinterface.php, allowing unauthenticated attackers to perform SQL injection.
• Adjust --time based on network latency (e.g., 10 seconds for slower responses).
• Wordlist directories are scanned for common files like rockyou.txt for credential cracking.
• Use responsibly on authorized systems only to avoid data breaches or site compromise.
• Contact me at [email protected] for support or issues!

Disclaimer

This tool is for educational and authorized security testing purposes only. Unauthorized exploitation of CVE-2019-9053 is illegal and unethical.