SQL Injection in code-projects Matrimonial System

CVE-2026-92366 is a critical SQL injection vulnerability identified in the Regular Search component of the code-projects Matrimonial System version 1.0. The vulnerability resides within the /search.php file, which fails to properly sanitize input provided through several GET or POST parameters, including sex, mothertongue, maritialstatus, country, state, religion, agemin, and agemax. An unauthenticated remote attacker can exploit this flaw by crafting malicious input strings containing SQL injection payloads. If successful, this can lead to unauthorized data exfiltration, modification of database contents, or potential escalation of access within the underlying database. The vulnerability has been publicly disclosed, increasing the risk of automated exploitation attempts against internet-facing instances of this software.

Impact

Successful exploitation of this SQL injection vulnerability allows an attacker to interact directly with the application's backend database. This may result in the complete compromise of stored user data, including personal identifiable information (PII) common to matrimonial platforms. If the database service account has excessive permissions, attackers could potentially gain deeper access to the host server environment or disrupt the service through malicious queries.

Recommendation

1. Identify all instances of code-projects Matrimonial System 1.0 within the organization via software inventory or network scanning.
2. Until a vendor-supplied patch is available, implement a Web Application Firewall (WAF) rule to inspect and block requests to /search.php containing SQL injection patterns in the specified parameters.
3. Deploy the provided Sigma rule to detect exploitation attempts against the /search.php endpoint.
4. Review database access logs for unusual patterns, such as UNION statements or error-based injection strings, originating from the web server.