# CVE-2019-9053

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

- Page: https://www.vulneraibility.com/cve/CVE-2019-9053
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 68.58% (percentile 99.3)
- Public exploit code: 1 on Exploit-DB · 46 GitHub proofs of concept (first 2019-04-02)
- Published: 2019-03-26

## Affected

- cmsmadesimple:cms_made_simple

## References

- [other] https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum
- [other] https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
- [exploit] https://www.exploit-db.com/exploits/46635/
- [other] http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html
- [other] https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.