支持本站 — 捐款将帮助我们持续运营

目标：1000 元，已筹：640 元

64.0%
立即捐款

POC详情： c6419ab00332d9e942a83ef7c28058d5b5264d77

来源
https://github.com/Perseus99999/CVE-2019-9053-working-
关联漏洞
标题：CMS Made Simple SQL注入漏洞 (CVE-2019-9053)
描述：CMS Made Simple（CMSMS）是CMSMS团队的一套开源的内容管理系统(CMS)。该系统支持基于角色的权限管理系统、基于向导的安装与更新机制、智能缓存机制等。 CMSMS 2.2.8版本中存在SQL注入漏洞，该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
描述
CMS Made Simple < 2.2.10 - SQL Injection . Actual working version
介绍
# CVE-2019-9053-working script-
CMS Made Simple &lt; 2.2.10 - SQL Injection . Actual working version

Updated the script to work with latest python versions
Added Exception Handling for each function
You can also calibrate time.sleep inside the exception handling blocks depending on response and connection timeout errors

The command syntax is

python3 exploit.py -u http://target-url/CMS-directory --crack -w /path-wordlist  


Wordlist Examples
rockyou.txt
seclists/Passwords/Common-Credentials/best110.txt


You will need to run the script multiple times to get the correct output. Since this is a Time-based SQL injection, it is highly reliant on your network latency. Feel free to change the TIME, time.sleep(), and timeout variables if outputs seem wrong or it goes into an indefinite loop. Be Patient.


This can also be used for the TryHackMe(THM) Room - Simple CTF

https://tryhackme.com/room/easyctf
文件快照

 [4.0K]  /data/pocs/c6419ab00332d9e942a83ef7c28058d5b5264d77
├── [7.7K]  exploit.py
├── [1.0K]  LICENSE
└── [ 912]  README.md

1 directory, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。