CVE-2019-25639
HIGHMatrimony Website Script M-Plus Multiple SQL Injection
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25639. PoCs published by Ahmet Ümit BAYRAM.
AI-analyzed exploit summary The exploit demonstrates multiple SQL injection vulnerabilities in Matrimony Website Script (M-Plus version) via crafted POST parameters. It includes five distinct attack patterns targeting different endpoints and parameters, confirming the vulnerability through boolean-based and time-based SQLi techniques.
Description
Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various POST parameters. Attackers can inject malicious SQL payloads into parameters like txtGender, religion, Fage, and cboCountry across simplesearch_results.php, advsearch_results.php, specialcase_results.php, locational_results.php, and registration2.php to extract sensitive database information or execute arbitrary SQL commands.
Exploits (1)
The exploit demonstrates multiple SQL injection vulnerabilities in Matrimony Website Script (M-Plus version) via crafted POST parameters. It includes five distinct attack patterns targeting different endpoints and parameters, confirming the vulnerability through boolean-based and time-based SQLi techniques.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N