The News module fails to sanitize the m1_idlist GET parameter, allowing an unauthenticated attacker to extract sensitive data from the database character by character using time delays.

Requirements

• Python 3.6+
• pip packages:

Usage

Basic — dump credentials only

With password cracking

Full options

Example

Expected output:

How It Works

1. Salt dump — queries cms_siteprefs table for the sitemask value (the password salt)
2. Username dump — extracts the username of user_id = 1 from cms_users
3. Email dump — extracts the email of user_id = 1 from cms_users
4. Password dump — extracts the MD5 password hash of user_id = 1 from cms_users
5. Crack (optional) — computes MD5(salt + wordlist_entry) for each line and compares against the dumped hash

The injection uses SELECT SLEEP(N) to infer each character — if the response is delayed, the guessed character is correct.

Tip: If the script is slow or unreliable, increase the TIME variable inside the script to account for network latency.

Python 3 Changes from Original

References

• Exploit-DB #46635 — Original exploit
• NVD — CVE-2019-9053
• CMS Made Simple

License

This project is for educational use only. Refer to the original exploit's licensing terms on Exploit-DB.