CVE-2019-9053-python3-remastered

The script has been remastered by Teymur Novruzov to ensure compatibility with Python 3. This tool is intended for educational purposes only. Unauthorized use of this tool on any system or network without permission is illegal. The author is not responsible for any misuse of this tool.

CMS Made Simple SQL Injection Exploit (Python 3) Overview This repository contains a Python 3 script that exploits a time-based SQL injection vulnerability in CMS Made Simple. The script has been remastered by Teymur Novruzov to ensure compatibility with Python 3.

Features Dumps sensitive information such as salt, username, email, and password. Optional password cracking feature using a wordlist. Utilizes a time-based SQL injection approach.

Requirements Python 3.x

Requests library (install via pip install requests) Usage Basic Usage

python3 exploit.py -u http://target-uri With Password Cracking

python3 exploit.py -u http://target-uri --crack

Options -u, --url: Specify the base target URL (e.g., http://10.10.10.100/cms) -c, --crack: Enable password cracking using a wordlist

Example python3 exploit.py -u http://10.10.10.100/cms python3 exploit.py -u http://10.10.10.100/cms --crack

How It Works Dump Salt: Extracts the salt used for hashing passwords. Dump Username: Extracts the username from the CMS database. Dump Email: Extracts the email associated with the user. Dump Password: Extracts the hashed password. Crack Password: (Optional) Attempts to crack the password using a wordlist. Important Notes Ensure the variable TIME is set appropriately as this SQL injection is time-based. This script is for educational purposes only. Use it responsibly and with permission.

Author Teymur Novruzov

License This project is licensed under the MIT License.

Example Output

[+] Salt for password found: abcdef [+] Username found: admin [+] Email found: [email protected] [+] Password found: 5f4dcc3b5aa765d61d8327deb882cf99
[] Now try to crack password [] Try: password [+] Password cracked: password

Disclaimer This tool is intended for educational purposes only. Unauthorized use of this tool on any system or network without permission is illegal. The author is not responsible for any misuse of this tool.