CVE-2019-25635
HIGHZeeways Matrimony CMS Lastest SQL Injection via profile_list
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25635. PoCs published by Ahmet Ümit BAYRAM.
AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in Zeeways Matrimony CMS via three different parameters (up_cast, s_mother, s_religion). The payloads use time-based blind SQLi techniques with concatenated strings to extract data.
Description
Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_list endpoint. Attackers can inject SQL code via the up_cast, s_mother, and s_religion parameters to extract sensitive database information using time-based or error-based techniques.
Exploits (1)
The exploit demonstrates SQL injection vulnerabilities in Zeeways Matrimony CMS via three different parameters (up_cast, s_mother, s_religion). The payloads use time-based blind SQLi techniques with concatenated strings to extract data.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N