关联漏洞
标题：
CMS Made Simple SQL注入漏洞
(CVE-2019-9053)
描述：CMS Made Simple（CMSMS）是CMSMS团队的一套开源的内容管理系统(CMS)。该系统支持基于角色的权限管理系统、基于向导的安装与更新机制、智能缓存机制等。 CMSMS 2.2.8版本中存在SQL注入漏洞，该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
介绍
# Disclaimer
This repository provides a Python 3 compatible exploit targeting an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. The flaw, tracked as CVE-2019-9053, allows attackers to extract sensitive administrator data, including username, hashed password, email, and salt.
The original exploit was authored by Daniele Scanu.
Original Exploit : https://www.exploit-db.com/exploits/46635
By using this script, you agree to:
Use it only on systems you own or have explicit permission to test. Not hold the author or contributors liable for any direct, indirect, or consequential damages resulting from its use.
# This script works in two modes
## Mode 1 : Exploiting without password cracking
To run the exploit and retrieve information about the CMS administrator **without attempting to crack the password**:
```bash
python3 CVE-2019-9053.py -u http://<TARGET-IP>/writeup
```
## Mode 2 : Exploiting with password cracking
```bash
python3 CVE-2019-9053.py -u http://<TARGET-IP>/writeup --crack -w /usr/share/wordlists/rockyou.txt
```
文件快照
[4.0K] /data/pocs/ff530cd85dea711a3943e6ad8d8d33974c902e91
├── [5.9K] CMS-Made-Simple-2.2.9-CVE-2019-9053.py
└── [1.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。