A critical SQL injection vulnerability in Netartmedia PHP Dating Site allows unauthenticated attackers to manipulate database queries and potentially extract sensitive information.

This is a time-based SQL injection vulnerability (CWE-89) occurring in the loginaction.php script. Unauthenticated attackers can submit malicious SQL payloads via the Email parameter in a POST request to compromise the underlying database.

The ability for an unauthenticated user to inject SQL commands into the application database poses a severe risk of data exfiltration and unauthorized access to user accounts. Given the CVSS score of 8.2, this vulnerability represents a high-severity threat that could lead to full database compromise, resulting in significant reputational damage and the loss of sensitive user information.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the login interface using network-level controls or a Web Application Firewall (WAF) until the vendor provides a secure update.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to loginaction.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or time-based command strings.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the Email parameter in authentication forms.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 46576.

The severity of this vulnerability, combined with the availability of public exploit material, necessitates immediate defensive action. Organizations utilizing Netartmedia PHP Dating Site must prioritize the implementation of WAF rules to block malicious input to the login module and should seek an alternative solution or contact the vendor for a security update if the product is no longer maintained.