SQL injection in CMS Made Simple - CVE-2019-9053
Published: October 8, 2019 / Updated: March 31, 2025
Vulnerability identifier: #VU21604
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9053
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "m1_idlist" parameter. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
CMS Made Simple
How to mitigate CVE-2019-9053
Install update from vendor's website.
CMS Made Simple - update to 2.2.10
Links to Public Exploits and PoC-codes
- Exploit #11263 - CVE-2019-9053 (Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts admin creds with time-based SQLi.) (March 31, 2025)
- Exploit #11192 - CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053- (This exploit targets an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.9 (CVE-2019-9053). It uses a time-based blind SQL injection to extract the username, (March 7, 2025)
- Exploit #10121 - SimpleCTF-UpdatedExploit (This script is a modified version of the original exploit by Daniele Scanu which exploits an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.10 (CVE-2019-9053).) (June 21, 2024)
- Exploit #9559 - CVE-2019-9053-Exploit-in-Python-3 () (February 23, 2024)
- Exploit #9323 - CVE-2019-9053-Exploit-Python-3 (The exploit is edited to work with different text encodings and Python 3 and is compatible with CMSMS version 2.2.9 and below.) (September 13, 2023)
- Exploit #9238 - CVE-2019-9053 (Original Exploit Source: https://www.exploit-db.com/exploits/46635) (August 7, 2023)
- Exploit #9172 - CVE-2019-9053 (This is the Updated Python3 exploit for CVE-2019-9053) (July 4, 2023)
- Exploit #8668 - CVE-2019-9053-Python3 (CVE-2019-9053 exploit ported to python3) (December 15, 2022)
- Exploit #8539 - CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit () (October 26, 2022)
- Exploit #8533 - CVE-2019-9053 (CVE-2019-9053 Exploit for Python 3) (October 25, 2022)
- Exploit #8450 - Simple_CMS_SQLi (This is a exploit for CVE-2019-9053) (October 8, 2022)
- Exploit #7885 - CVE-2019-9053 (CVE-2019-9053 Exploit for Python 3) (May 24, 2022)
- Exploit #5936 - CMS Made Simple < 2.2.10 - SQL Injection (June 17, 2021)
- Exploit #5411 - 46635.py_CVE-2019-9053 (This is modified code of 46635 exploit from python2 to python3.) (May 16, 2021)
- Exploit #5158 - CMS Made Simple Serverside Template Injection Remote Code Execution Vulnerability (February 19, 2021)