CVE-2019-9053

CMS Made Simple < 2.2.10 - SQL Injection

Severity Score

8.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

Se ha descubierto un problema en CMS Made Simple 2.2.8. En el módulo News, mediante una URL manipulada, es posible lograr una inyección SQL ciega basada en tiempo mediante el parámetro m1_idlist.

CMS Made Simple versions prior to 2.2.10 suffer from a remote SQL injection vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-02-23 CVE Reserved
2019-03-26 CVE Published
2022-12-14 First Exploit
2024-08-04 CVE Updated
2024-08-16 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (20)

URL	Tag	Source

URL	Date	SRC
https://www.exploit-db.com/exploits/46635	2024-08-04
https://github.com/e-renna/CVE-2019-9053	2023-05-09
https://github.com/Mahamedm/CVE-2019-9053-Exploit-Python-3	2024-06-09
https://github.com/N3rdyN3xus/CVE-2019-9053	2024-08-09
https://github.com/ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit	2023-06-30
https://github.com/davcwikla/CVE-2019-9053-exploit	2023-11-26
https://github.com/kahluri/CVE-2019-9053	2023-08-07
https://github.com/fernandobortotti/CVE-2019-9053	2023-10-16
https://github.com/byrek/CVE-2019-9053	2023-11-20
https://github.com/im-suman-roy/CVE-2019-9053	2023-07-04
https://github.com/BjarneVerschorre/CVE-2019-9053	2023-11-30
https://github.com/pedrojosenavasperez/CVE-2019-9053-Python3	2022-12-14
https://github.com/FedericoTorres233/CVE-2019-9053-Fixed	2024-05-17
https://github.com/jtoalu/CTF-CVE-2019-9053-GTFOBins	2024-08-09
https://github.com/Doc0x1/CVE-2019-9053-Python3	2023-10-16
https://github.com/TeymurNovruzov/CVE-2019-9053-python3-remastered	2024-06-25
https://github.com/Jason-Siu/CVE-2019-9053-Exploit-in-Python-3	2024-02-21
http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html	2024-08-04

URL	Date	SRC

URL	Date	SRC
https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg	2019-04-24
https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum	2019-04-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cmsmadesimple Search vendor "Cmsmadesimple"		Cms Made Simple Search vendor "Cmsmadesimple" for product "Cms Made Simple"				2.2.8 Search vendor "Cmsmadesimple" for product "Cms Made Simple" and version "2.2.8"		-		Affected