Attack Chain

1. An unauthenticated attacker identifies a Matrimony Website Script M-Plus instance.
2. The attacker crafts a malicious HTTP POST request targeting one of the vulnerable PHP files: simplesearch_results.php, advsearch_results.php, specialcase_results.php, locational_results.php, or registration2.php.
3. The attacker injects SQL code into one or more of the following parameters: txtGender, religion, Fage, or cboCountry.
4. The web server processes the malicious POST request, passing the injected SQL code to the database server without proper sanitization or input validation.
5. The database server executes the injected SQL code, potentially allowing the attacker to extract sensitive data (e.g., user credentials, personal information) using SQL injection techniques like UNION-based injection.
6. Alternatively, the attacker could execute arbitrary SQL commands to modify data, create new accounts, or potentially gain control over the database server.
7. The attacker retrieves the results of the SQL query from the web server's response.
8. The attacker uses the extracted data or control over the database to further compromise the system.

Impact

Successful exploitation of these SQL injection vulnerabilities could lead to the complete compromise of the Matrimony Website Script M-Plus instance. Attackers could gain unauthorized access to sensitive user data, including personal details, contact information, and potentially financial data. This could result in identity theft, financial fraud, and reputational damage for both the website operator and its users. The impact is significant given the potential for widespread data breaches and the high CVSS score of 8.2.

Recommendation

• Inspect web server logs for suspicious POST requests targeting simplesearch_results.php, advsearch_results.php, specialcase_results.php, locational_results.php, and registration2.php, especially those containing SQL syntax in the txtGender, religion, Fage, or cboCountry parameters to detect potential exploitation attempts (see the rules below).
• Apply any available patches or updates for Matrimony Website Script M-Plus to address CVE-2019-25639.
• Implement proper input validation and sanitization techniques to prevent SQL injection vulnerabilities in the Matrimony Website Script M-Plus, especially for the txtGender, religion, Fage, and cboCountry parameters.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.