Executive brief
The Matrimonial System is a PHP web application used to manage matrimonial profiles and partner preferences. A SQL injection vulnerability in the partner preference form allows attackers to manipulate database queries and extract sensitive data, including user credentials and personal information stored in the system.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the writepartnerprefs() function within partner_preference.php. User input from the education parameter (and other POST parameters) is directly concatenated into a SQL UPDATE query without sanitization or parameterized prepared statements. The vulnerable code constructs: UPDATE partnerprefs SET education='$education' WHERE custId='$id'. An unauthenticated or authenticated attacker can submit malicious SQL payloads via the education parameter to execute arbitrary SQL queries, enumerate the database, and extract credentials and sensitive data. No patch information is currently available for version 1.0.
Affected products
- Code Projects Matrimonial System 1.0
Timeline
- 2026-09-17: disclosed
- 2026-09-25: other: Public proof-of-concept and technical writeup published on GitHub