关联漏洞
标题：
CMS Made Simple SQL注入漏洞
(CVE-2019-9053)
描述：CMS Made Simple（CMSMS）是CMSMS团队的一套开源的内容管理系统(CMS)。该系统支持基于角色的权限管理系统、基于向导的安装与更新机制、智能缓存机制等。 CMSMS 2.2.8版本中存在SQL注入漏洞，该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
介绍
# CMS Made Simple <= 2.2.9 Unauthenticated SQL Injection Exploit (Python 3)
## Overview
This exploit performs an **unauthenticated time-based blind SQL injection** against **CMS Made Simple <= 2.2.9**, allowing extraction of:
* Salt used for password hashing
* Admin username
* Admin email
* Password hash
Optionally, it can **crack the password** using a provided wordlist.
---
## Files
* `cmsms_sqli_py3.py` – Python 3 exploit script.
---
## Requirements
* Python 3 (pre-installed on Kali)
* `termcolor` module:
```bash
pip install termcolor
```
* Wordlist for cracking (optional), e.g., `/usr/share/wordlists/rockyou.txt`
---
## Usage
### Basic extraction (salt, username, email, password hash):
```bash
python3 cmsms_sqli_py3.py -u http://target-uri
```
### Extract and crack password using a wordlist:
```bash
python3 cmsms_sqli_py3.py -u http://target-uri --crack -w /path/to/wordlist.txt
```
**Example:**
```bash
python3 cmsms_sqli_py3.py -u http://simplectf.thm/simple/ --crack -w /usr/share/wordlists/rockyou.txt
```
---
## How it Works
* Performs **time-based blind SQL injection** on:
```
moduleinterface.php?mact=News,m1_,default,0&m1_idlist=<payload>
```
* Extracts data **character by character** by checking response delays.
* Extracts:
* Salt (`cms_siteprefs` table)
* Admin username (`cms_users`)
* Admin email (`cms_users`)
* Admin password hash (`cms_users`)
* Optionally attempts to crack the extracted hash using the provided wordlist and salt.
---
## Notes
✅ Fully Python 3 compatible (stable on TryHackMe/HTB workflows).
✅ Works within your **virtual environment** (venv) cleanly.
✅ Uses color output for clear tracking of progress.
---
## Disclaimer
This exploit is for **educational purposes only**. Do not use it on systems you do not own or have explicit permission to test.
---
## Credits
* Original Python 2 Exploit: Daniele Scanu @ Certimeter Group
* Python 3 Conversion and Cleanup: ChatGPT (OpenAI)
---
If you need automatic reporting of extracted credentials or auto-login payload generation for your pentest workflow, let me know.
文件快照
[4.0K] /data/pocs/14df9fb7237bf9422bc0fa381afcb49fc046eca3
├── [4.1K] cmsms_sqli_py3.py
└── [2.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。