Matrimonial System
Monthly
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.