Cracking TryHackMe’s “Simple CTF”: SQLi & CVE-2019-9053 in the Wild

#security #cybersecurity #tryhackme #learning

"You don’t need permission to test the lock — only the courage to pick it."

I recently tackled the Simple CTF room on TryHackMe — an entry-level but deeply satisfying box that reminded me how simplicity often hides sharp vulnerabilities.

Phase 1: Reconnaissance
Started with the usual:

nmap -sC -sV -oN simplectf.nmap

Dropped a scan. Ports 80 and 2222 welcomed me.

Ran Gobuster to enumerate directories:

gobuster dir -u http:// -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Discovered /login.php and /robots.txt, which hinted at hidden admin or CMS content.

Phase 2: Exploiting SQL Injection
Manual testing of the login form revealed it was vulnerable to SQL Injection.
bypassed authentication — a red flag in any real-world app.

Phase 3: CVE-2019-9053 – CuteNews CMS Exploit
Digging deeper into the /CuteNews directory, I identified the CMS as CuteNews v2.1.2, vulnerable to a well-known Remote Code Execution (RCE) flaw — CVE-2019-9053.

Exploited it using a Python script to upload a malicious PHP shell, then escalated privileges from there.

Payload Delivered. Root Access Secured.
Enumerated.
Escalated.
Exfiltrated.

Both user and root flags were claimed.
But more than that — control was mine.

What They Forgot:
[@] Input fields aren’t boxes. They’re entry points.

[@] A CMS is only “Cute” until it leaks.

[@] Security is a myth when curiosity is weaponized.

If you're reading this and building something — ask yourself:
Would it survive the hackers?
Because we won’t knock.