CVE-2026-92366: Matrimonial System 1.0 SQL Injection Flaw

CVE-2026-92366 Overview

CVE-2026-92366 is a SQL injection vulnerability in code-projects Matrimonial System 1.0. The flaw resides in the /search.php file, specifically within the Regular Search component. Attackers can manipulate the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters to inject arbitrary SQL statements. The attack requires no authentication and can be executed remotely over the network. Public proof-of-concept exploits are already available on GitHub, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is classified under CWE-74 as improper neutralization of special elements in output used by a downstream component.

Critical Impact

Unauthenticated remote attackers can inject SQL statements through multiple search parameters, potentially exposing user data stored in the matrimonial database.

Affected Products

• code-projects Matrimonial System 1.0
• /search.php Regular Search component
• Deployments exposing the search endpoint to untrusted networks

Discovery Timeline

• 2026-09-16 - CVE-2026-92366 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92366

Vulnerability Analysis

The vulnerability exists in the Regular Search functionality of the Matrimonial System application. The /search.php script accepts eight user-controlled parameters and passes them into a backend SQL query without proper sanitization or parameterization. Because the input flows directly into the query string, an attacker can break out of the intended query context and append arbitrary SQL clauses.

The attack surface is broad. Any of the eight parameters (sex, mothertongue, maritialstatus, country, state, religion, agemin, agemax) can serve as an injection point. Public proof-of-concept material on GitHub demonstrates exploitation through the sex and mothertongue parameters. See the GitHub PoC for the sex parameter and the GitHub PoC for the mothertongue parameter for technical details.

Root Cause

The root cause is missing input validation and lack of prepared statements in the /search.php handler. User-supplied search filters are concatenated directly into the SQL query. This design pattern allows special SQL metacharacters such as single quotes, comments, and UNION keywords to alter the intended query logic.

Attack Vector

Exploitation occurs remotely over HTTP. An unauthenticated attacker sends crafted GET or POST requests to /search.php with malicious values in any of the affected parameters. Successful injection can enable data extraction from the underlying database, including account records, contact details, and other personally identifiable information stored by the matrimonial application. See the VulDB entry for CVE-2026-92366 for additional analysis.

No synthetic exploit code is reproduced here. Refer to the linked proof-of-concept repositories for verified payload examples.

Detection Methods for CVE-2026-92366

Indicators of Compromise

• HTTP requests to /search.php containing SQL metacharacters such as single quotes, --, /*, UNION SELECT, or SLEEP( in the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters.
• Web server logs showing unusually long query strings or repeated variations against the search endpoint from a single source.
• Database error messages returned to clients, indicating the application is echoing SQL syntax errors.

Detection Strategies

• Deploy a Web Application Firewall (WAF) signature that flags SQL injection patterns targeting the /search.php endpoint.
• Enable database query logging and alert on anomalous query structures originating from the matrimonial application service account.
• Correlate web access logs with database audit logs to identify search requests that trigger unexpected UNION or INFORMATION_SCHEMA queries.

Monitoring Recommendations

• Baseline normal parameter values for the eight affected fields and alert on values containing SQL keywords or encoded payloads.
• Monitor for spikes in 500-series HTTP responses from /search.php, which often indicate injection attempts triggering backend errors.
• Track outbound data volume from the database server to detect potential mass extraction following successful exploitation.

How to Mitigate CVE-2026-92366

Immediate Actions Required

• Restrict public network access to the Matrimonial System application until a patched build is available.
• Deploy WAF rules that block SQL injection patterns against /search.php parameters.
• Review web server and database logs for evidence of prior exploitation attempts using the parameters listed in the advisory.
• Rotate database credentials if the application is internet-facing and injection activity is suspected.

Patch Information

No official vendor patch is referenced in the enriched CVE data at the time of publication. The vendor resource is available at code-projects.org. Administrators should monitor the vendor site and the VulDB vulnerability record #405452 for remediation updates.

Workarounds

• Modify /search.php to use parameterized queries or prepared statements for all eight affected parameters.
• Apply strict allowlist validation on search inputs, restricting values to expected data types (for example, integers for agemin and agemax).
• Run the application database account with least-privilege permissions, denying access to system tables and write operations where not required.
• Place the application behind an authenticated reverse proxy if it must remain internet-accessible during remediation.

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:sex|ARGS:mothertongue|ARGS:maritialstatus|ARGS:country|ARGS:state|ARGS:religion|ARGS:agemin|ARGS:agemax \
  "@rx (?i)(union\s+select|sleep\(|--|/\*|';)" \
  "id:1092366,phase:2,deny,status:403,msg:'CVE-2026-92366 SQLi attempt on /search.php'"