The Matri4Web Matrimony Website Script M-Plus is vulnerable to multiple SQL injection flaws, allowing unauthenticated attackers to extract sensitive data or execute arbitrary database commands.

The application fails to properly sanitize user input in multiple PHP files, including simplesearch_results.php and registration2.php. An unauthenticated attacker can inject malicious SQL payloads into POST parameters such as txtGender, religion, Fage, and cboCountry to compromise the backend database.

Successful exploitation of these SQL injection vulnerabilities poses a severe risk to data confidentiality and integrity. An attacker can bypass application logic to extract sensitive user information, such as personal profiles or authentication credentials, potentially leading to a complete compromise of the application database. With a CVSS score of 8.2, this vulnerability is considered high risk, necessitating immediate attention to prevent unauthorized data access or potential account takeover.

Immediate Action: There is no official vendor patch available for this legacy script. Administrators should immediately restrict access to the affected PHP files or replace the vulnerable software with a secure alternative.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax errors or unexpected character sequences in POST requests to the identified search and registration endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the vulnerable parameters before they reach the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the ExploitDB entry 46591.

Given the lack of vendor-provided updates and the availability of public exploit code, the risk associated with this vulnerability is significant. Organizations using Matrimony Website Script M-Plus should prioritize migrating to a supported platform. If migration is not immediately feasible, aggressive WAF filtering and strict network segmentation are required to mitigate the risk of unauthorized database interaction.