# **CMS-Made-Simple-2.2.9 - SQL-Injection-Exploit - CVE-2019-9053**
## **Description**
This repository contains an exploit for an unauthenticated SQL injection vulnerability in **CMS Made Simple** versions **2.2.9** and earlier. This vulnerability, identified under **CVE-2019-9053**, allows an attacker to retrieve sensitive information such as the **username**, **hashed password**, **email**, and **salt** of the CMS administrator.
The original script was written by **Daniele Scanu** from **Certimeter Group** and has been updated by **Azrenom** to be compatible with **Python 3** and to include several optimizations for error handling and overall stability.
## **Features**
- Extraction of **salt**, **username**, **email**, and **hashed password** of the CMS administrator.
- Ability to **crack** the administrator's password using a wordlist through brute force.
- Compatible with **Python 3**.
- Handles encoding errors when reading wordlists.
## **Requirements**
- **Python 3.x**
- **Python libraries**:
- `requests`
- `termcolor`
### **Installing Dependencies**
Before running the script, install the required dependencies using pip:
**`pip install requests termcolor`**
## **Usage**
### 1. **Exploiting without password cracking**
To run the exploit and retrieve information about the CMS administrator without attempting to crack the password:
**`python3 exploit.py -u http://[TARGET-IP]/cms`**
Replace \`[TARGET-IP]\` with the actual IP address or URL where **CMS Made Simple** is hosted.
### 2. **Exploiting with password cracking**
If you have a wordlist and want to attempt cracking the administrator's password after retrieving the salt and hashed password:
**`python3 exploit.py -u http://[TARGET-IP]/cms --crack -w /usr/share/wordlist/dirb/big.txt`**
### **Available Options**
| **Option** | **Description** |
|----------------------|--------------------------------------------------------------------------------|
| \`-u\` or \`--url\` | **Required**. Target CMS URL (e.g. \`http://10.10.10.100/cms\`) |
| \`-w\` or \`--wordlist\` | **Optional**. Path to the wordlist to crack the password |
| \`-c\` or \`--crack\` | **Optional**. Enables password cracking after completing the exploit |
## **How the script works**
The script operates in several stages:
1. **Salt extraction**: Using an SQL injection, the script retrieves the salt used to hash the administrator's password.
2. **Retrieving credentials**: The script retrieves the administrator's **username**, **email**, and **hashed password**.
3. **Password cracking**: If the \`--crack\` option is enabled, the script attempts to crack the password using a wordlist.
4. **Results display**: The extracted information is printed in the terminal.
## **Limitations**
- This attack is based on a **time-based SQL injection**; thus, depending on the server configuration, it may take more time.
- The password **cracking** functionality relies on a wordlist. Without an adequate wordlist, cracking the password may not be successful.
## **Disclaimer**
> **This script is provided for educational and research purposes only. Any use against systems without explicit permission from the owner is illegal. Use it only in controlled environments or with proper authorization.**
---
## **Contributing**
If you'd like to contribute to this project, you can:
1. Fork the repository.
2. Create a branch for your changes.
3. Submit a pull request with a clear description of the changes.
[4.0K] /data/pocs/fbd9abca6ec8a06bd363435a410dcbf43c2899ab
├── [6.5K] exploit.py
└── [3.5K] README.md
0 directories, 2 files