CVE-2019-25635 - Vulnerability Analysis

Overview

Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities caused by unsanitized input in the profile_list endpoint parameters up_cast, s_mother, and s_religion, letting unauthenticated attackers extract sensitive database information via time-based or error-based techniques.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information, potentially compromising the entire database.

Mitigation

Update to the latest version of Zeeways Matrimony CMS.

References

• http://www.zeeways.com/matrimony-cms/4/productdetail
• https://www.exploit-db.com/exploits/46603
• https://www.vulncheck.com/advisories/zeeways-matrimony-cms-lastest-sql-injection-via-profile-list

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner