CVE-2017-17639
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands via the succid parameter in success-story.php in Muslim Matrimonial Script 3.02. This affects all installations of version 3.02 that expose the vulnerable script to user input.
💻 Affected Systems
- Muslim Matrimonial Script
📦 What is this software?
Muslim Matrimonial Script by Muslim Matrimonial Script Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, user information theft, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Public exploit code available, requires no authentication, and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - No official patch from vendor identified
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
1. Upgrade to a newer version if available 2. Manually patch the vulnerable success-story.php file 3. Implement parameterized queries for all database interactions
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to ensure succid parameter contains only numeric values
// In success-story.php, add: if(!is_numeric($_GET['succid'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection attempts targeting success-story.php
WAF rule: Block requests to success-story.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Block access to success-story.php at network perimeter
- Implement strict input validation and use prepared statements for all database queries
🔍 How to Verify
Check if Vulnerable:
Test by accessing success-story.php?succid=1' OR '1'='1 and checking for SQL errors or unexpected behaviorCheck Version:
Check script files for version information or review installation documentationVerify Fix Applied:
Test the same injection attempt and verify proper error handling or rejection occurs📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Multiple requests to success-story.php with unusual parameters
- Database error logs showing injection attempts
Network Indicators:
- HTTP requests to success-story.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri="*success-story.php*" AND (param="*succid*" AND value="*' OR*" OR value="*UNION*" OR value="*SELECT*")