CVE-2019-9053: CMS Made Simple News module unauthenticated blind SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote SQL injection with public exploit code and very high EPSS probability, though not listed in KEV.

What it is

CMS Made Simple 2.2.8 is vulnerable to unauthenticated blind time-based SQL injection in the News module via the m1_idlist parameter in a crafted URL. The flaw allows an attacker to inject SQL into backend queries without logging in, which matters because it exposes the site's database contents and can lead to full compromise of the CMS.

Impact

An attacker can extract arbitrary data from the underlying database, including CMS user credentials and content, and may be able to modify or destroy data depending on database privileges. This can lead to administrative account takeover and full site compromise.

Attack surface

Reachable remotely over HTTP through the News module by supplying a crafted m1_idlist parameter; no authentication or user interaction is required per the CVSS vector (PR:N, UI:N).

Exploitation

Public exploit code exists (Exploit-DB 46635 and Packet Storm references), and EPSS is 0.68581 (99.3rd percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade CMS Made Simple to 2.2.10 or later, which the vendor advisory identifies as the fixed release.
• If immediate upgrade is not possible, disable or remove the News module until patched.
• Deploy a WAF rule to block SQL injection patterns targeting the m1_idlist parameter.
• Restrict database account privileges used by the CMS to the minimum required.
• Audit CMS user accounts and rotate credentials in case of prior compromise.

Detection

• Monitor web server logs for requests to News module URLs containing suspicious m1_idlist values, especially SQL keywords, quotes, or time-delay functions.
• Look for repeated requests with time-delay payloads (e.g., SLEEP, BENCHMARK) that produce unusually long response times.
• Alert on database errors or anomalous query patterns originating from the web application.
• Review CMS logs and file integrity for signs of post-exploitation activity following SQL injection attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.