An unauthenticated SQL injection vulnerability in Zeeways Matrimony CMS allows remote attackers to compromise backend database integrity and confidentiality.

The application fails to properly sanitize user input within the profile_list endpoint. Attackers can leverage the up_cast, s_mother, and s_religion parameters to execute arbitrary SQL commands, including time-based or error-based extraction techniques, without requiring authentication.

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized extraction of sensitive user data, administrative credentials, or personally identifiable information stored within the backend database. Given the CVSS score of 8.2, this vulnerability represents a high-severity threat that could result in significant reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict public access to the affected profile_list endpoint or disable the vulnerable module entirely until a vendor-supplied fix is released.

Proactive Monitoring: Security teams should implement enhanced logging for all database queries and monitor for anomalous traffic patterns, specifically looking for SQL syntax characters such as single quotes, semicolons, and comment indicators within the identified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets specifically configured to detect and block SQL injection patterns targeting the identified vulnerable parameters.

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via the Exploit-DB entry 46603.

The presence of a public proof-of-concept combined with the lack of authentication makes this vulnerability a significant target for automated scanning and exploitation. Organizations utilizing Zeeways Matrimony CMS must prioritize the implementation of compensating controls, such as WAF rules or network-level access restrictions, to mitigate the exposure of the database until an official security update is provided by the vendor.