Description
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- CMS Made Simple < 2.2.10 - SQL Injection EDB-46635 · webapps · Apr 2, 2019
GitHub 46 repositories · most starred shown
-
4nner/CVE-2019-9053 ★ 11 · Dec 28, 2021
CVE-2019-9053 Exploit for Python 3
-
Mahamedm/CVE-2019-9053-Exploit-Python-3 ★ 8 · May 29, 2023
The exploit is edited to work with different text encodings and Python 3 and is compatible with CMSMS version 2.2.9 and below.
-
Dh4nuJ4/SimpleCTF-UpdatedExploit ★ 5 · Jun 20, 2024
This script is a modified version of the original exploit by Daniele Scanu which exploits an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.10 (CVE-2019-9053).
-
ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit ★ 5 · Oct 25, 2022
-
Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053 ★ 3 · Sep 21, 2024
-
h3x0v3rl0rd/CVE-2019-9053 ★ 3 · Jul 18, 2021
-
JagdeepSinghCeh/cms-made-simple-python3 ★ 2 · Nov 15, 2025
Python3-converted exploit and research notes for CMS Made Simple (CVE-2019-9053) — Unauthenticated SQL Injection vulnerability. Includes original PoC, improved Python3 version, usage instructions, an…
-
TeymurNovruzov/CVE-2019-9053-python3-remastered ★ 1 · Jun 25, 2024
The script has been remastered by Teymur Novruzov to ensure compatibility with Python 3. This tool is intended for educational purposes only. Unauthorized use of this tool on any system or network wi…
-
fernandobortotti/CVE-2019-9053 ★ 1 · Oct 16, 2023
This repository has the sole purpose of rewriting the CVE-2019-9053 script, which in the original publication is written in Python 2.7. I will be using Python 3.
-
d3athcod3/46635.py_CVE-2019-9053 ★ 1 · May 14, 2021
This is modified code of 46635 exploit from python2 to python3.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum
- https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
- 46635 exploit
- http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html
- https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py