vendor:
Shaadi Zone
by:
e.wiZz!
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Shaadi Zone
Affected Version From: 1.0.9
Affected Version To: 1.0.9
Patch Exists: NO
Related CWE: N/A
CPE: a:vastal_i_tech:shaadi_zone:1.0.9
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Vastal I Tech Shaadi Zone 1.0.9 SQL Injection Vulnerability
Shaadi Zone is the best solution if you are looking to run a matrimonial services services. An attacker can exploit a SQL injection vulnerability in the keyword_search_action.php file by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in the 'fage' and 'tage' parameters. This can be exploited to disclose the contents of the database.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All input data should be validated and filtered before being passed to the SQL server.
