{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/matrimony-cms/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["sql-injection","web-application","matrimony-cms"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eZeeways Matrimony CMS is susceptible to SQL injection vulnerabilities affecting the profile_list endpoint. This vulnerability allows unauthenticated attackers to inject malicious SQL code through the \u003ccode\u003eup_cast\u003c/code\u003e, \u003ccode\u003es_mother\u003c/code\u003e, and \u003ccode\u003es_religion\u003c/code\u003e parameters. Successful exploitation could lead to unauthorized access to sensitive data within the database. The vulnerability was reported in CVE-2019-25635. The vulnerable software is Zeeways Matrimony CMS, and it\u0026rsquo;s crucial for organizations using this CMS to apply necessary patches or mitigations to prevent potential data breaches. Defenders should prioritize monitoring web server logs for suspicious activity targeting these specific parameters and the \u003ccode\u003eprofile_list\u003c/code\u003e endpoint.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a Zeeways Matrimony CMS instance.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP GET or POST request targeting the \u003ccode\u003eprofile_list\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker injects SQL code into the \u003ccode\u003eup_cast\u003c/code\u003e, \u003ccode\u003es_mother\u003c/code\u003e, or \u003ccode\u003es_religion\u003c/code\u003e parameters of the HTTP request.\u003c/li\u003e\n\u003cli\u003eThe web server processes the request and executes the injected SQL code against the database.\u003c/li\u003e\n\u003cli\u003eDepending on the injected SQL, the attacker can extract sensitive information from the database, such as user credentials or personal details, using time-based or error-based techniques.\u003c/li\u003e\n\u003cli\u003eThe attacker analyzes the extracted data to identify valuable information.\u003c/li\u003e\n\u003cli\u003eThe attacker may use the extracted credentials to further compromise the system or access other resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SQL injection vulnerability could lead to a full database compromise, potentially exposing sensitive user data including personal information, credentials, and financial details. This can result in significant reputational damage, financial losses due to regulatory fines, and legal repercussions for organizations using the vulnerable Zeeways Matrimony CMS. The impact is high due to the ease of exploitation (unauthenticated) and the potential for complete data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInspect web server logs for suspicious HTTP requests targeting the \u003ccode\u003e/profile_list\u003c/code\u003e endpoint with SQL injection attempts in the \u003ccode\u003eup_cast\u003c/code\u003e, \u003ccode\u003es_mother\u003c/code\u003e, and \u003ccode\u003es_religion\u003c/code\u003e parameters (see IOC table and enable webserver logging).\u003c/li\u003e\n\u003cli\u003eApply available patches or updates for Zeeways Matrimony CMS to address CVE-2019-25635.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided to detect exploitation attempts targeting the specified parameters in the URL.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization for all user-supplied data, especially for parameters used in database queries to prevent future SQL injection vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-24T12:16:04Z","date_published":"2026-03-24T12:16:04Z","id":"/briefs/2026-03-zeeways-sql-injection/","summary":"Zeeways Matrimony CMS is vulnerable to SQL injection via the profile_list endpoint, where an unauthenticated attacker can inject SQL code via the up_cast, s_mother, and s_religion parameters, potentially allowing them to extract sensitive information.","title":"Zeeways Matrimony CMS Unauthenticated SQL Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-03-zeeways-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed — Matrimony-Cms","version":"https://jsonfeed.org/version/1.1"}