EUVD-2026-98091
GHSA-9949-c3cx-q82w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Matrimonial System host
-
ExploitRequest db/matrimony.sql directly
-
ExecutionServer serves raw SQL dump
-
ImpactHarvest schema and stored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Direct request prevention
|
| Exploitation Conditions | Exploitation requires that the application's SQL dump file db/matrimony.sql be deployed within the web-accessible document root and served as a static file by the web server (the default layout of this project), allowing an unauthenticated remote attacker to retrieve it via a direct HTTP request. What LIMITS exploitation: the condition is void if the db/ directory is placed outside the webroot, blocked by server access rules, or the deployment restricts static .sql serving; exposure also only yields confidentiality impact (VC:L) and no write/modify capability. The low real-world footprint of the product is itself the primary limiting factor. |
| Impact | This is a high-CVSS-label-but-low-real-risk issue in practice. The CVSS 4.0 base metrics (AV:N/AC:L/AT:N/PR:N/UI:N) describe trivial remote unauthenticated access, but the impact is narrow - VC:L with VI:N/VA:N means only limited confidentiality loss (information disclosure via CWE-425, Direct Request / Forced Browsing) and no integrity or availability impact, consistent with the 5.5 MEDIUM score. The input carries E:P, indicating a proof-of-concept exploit has been published, but there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active or widespread exploitation. Crucially, the affected product - code-projects Matrimonial System 1.0 - is a small open-source/student-grade PHP application with negligible production deployment, which drives real-world priority far below what the network-vector metrics alone suggest. One data tension to verify: the description's phrasing ('some unknown processing of the file db/matrimony.sql', 'This manipulation causes files or directories accessible') is vague and auto-generated by the VulDB CNA, so the exact exploitation mechanism should be confirmed against the published PoC rather than taken as precise. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker directly requests the predictable path db/matrimony.sql on a deployed Matrimonial System instance and the web server returns the raw SQL dump, exposing the database schema and any seeded credentials or user data. A public proof-of-concept for this forced-browsing information disclosure has been published (CVSS E:P), lowering the skill required. Because the attack complexity is low (AC:L) and no user interaction or authentication is needed, exploitation is a single HTTP GET request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Direct HTTP requests to the db/matrimony.sql database dump in code-projects Matrimonial System 1.0 expose the application's schema and stored records to unauthenticated remote attackers (CVSS 4.0 base 5.5; assessed CVSS 3.1 5.3, CWE-425). The weakness is forced browsing: the SQL dump ships inside the web-accessible document root, so a predictable GET to the file returns it as a static asset with no authentication required (CVSS vector PR:N). Publicly available exploit code exists - the reporter published a proof-of-concept walkthrough on GitHub - but there is no CISA KEV listing, and impact is limited to confidentiality (VC:L) with no integrity or availability effect; the product's very small deployment footprint is the main practical limiter.
RemediationAI
No vendor-released patch identified at time of analysis; code-projects does not appear to have published a fixed build for Matrimonial System 1.0 (confirmed against the references above). The primary fix is deployment-side: relocate the db/ directory outside the web-accessible document root so db/matrimony.sql can never be served, and delete the dump from production hosts after the schema is imported, since the file has no runtime role. If relocation is not immediately possible, add a server rule that denies the path - for Apache, <FilesMatch "\.sql$"> Require all denied </FilesMatch> inside the virtual host; for nginx, location ~* \.sql$ { deny all; } - and verify with a direct GET that the file now returns 403/404. Trade-off: blanket .sql denial will also block any legitimate download tooling that intentionally serves dumps, which is rare and can be handled with an explicit per-file allowlist. Because the dump almost certainly contains seeded administrator credentials and password hashes, treat the exposed contents as compromised: rotate database accounts and application admin passwords referenced in the dump, and update the application's configuration files accordingly. VulDB advisories are at https://vuldb.com/vuln/416762, with the submitter's proof-of-concept at https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md; blocking external access to .sql paths also removes the easiest reconnaissance channel for follow-on attacks against the same host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-425 (Direct Request / Forced Browsing) exposure rather than an injection or memory-safety defect. The application's installation bundle places a raw SQL dump, db/matrimony.sql, inside the web root; because web servers serve unrecognized-but-static extensions like .sql by default, the file is retrievable at a predictable URL such as http://host/db/matrimony.sql without any session, cookie, or application logic being involved. The retrieved file typically contains full table definitions, insert statements, and often seeded administrator credentials and password hashes, making it a reconnaissance and credential-reuse stepping stone rather than a direct code-execution primitive. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N confirms a network-reachable, unauthenticated, no-preconditions path with low confidentiality-only impact and no subsequent-system impact; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with that reading. No CPE strings were supplied in the feed, so the affected product is identified by name and version rather than by a structured CPE identifier. No EPSS score was provided, so no probability estimate can be quoted.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated single-request forced browsing (AV:N/AC:L/PR:N/UI:N) that only discloses a SQL file, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB