Karanparelkar

**Name of the Vulnerable Software and Affected Versions** Matrimonial System version 1.0 **Description** Remote SQL injection is possible via the Profile Creation Endpoint. The issue occurs in the `processprofile form()` function within the `/create profile` file when handling the `fname` variable. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update Matrimonial System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/create profile` endpoint or avoid using the `fname` parameter until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** Cross site scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing an attacker to execute malicious scripts in the victim's browser. A remote attack is possible through the manipulation of the `full name` argument within the `/drug recommender/index.php` endpoint. **Recommendations** Update SourceCodester Drug Recommendation System version 1.0 to a version that contains a fix for this issue. As a temporary workaround, restrict access to the `/drug recommender/index.php` endpoint or sanitize the `full name` input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** A security flaw allows remote exploitation via cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue exists in the file `/drug recommender/Admin/add symptom` and is triggered by manipulating the `txtname` argument. **Recommendations** As a temporary mitigation, restrict access to the `/drug recommender/Admin/add symptom` file or avoid using the `txtname` argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** Cross site scripting (XSS) occurs in the User Management component within the file `/drug recommender/Admin/add user`. A remote attacker can execute this attack by manipulating the `txtname`, `txtemail`, or `txtpassword` variables. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** As a temporary workaround, restrict access to the `/drug recommender/Admin/add user` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** An issue exists in the Password Change component within the file '/drug recommender/Admin/change password'. Remote attackers can perform cross-site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the `txtoldpassword` and `txtnewpassword` variables. **Recommendations** Update SourceCodester Drug Recommendation System version 1.0 to a version that addresses this issue. As a temporary mitigation, restrict access to the '/drug recommender/Admin/change password' endpoint.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** A SQL injection flaw exists in the `/Admin/edit symptom.php` endpoint. This issue occurs when the `ID` argument is manipulated, allowing a remote attacker to execute arbitrary SQL commands. **Recommendations** Update SourceCodester Drug Recommendation System to a version newer than 1.0. As a temporary mitigation, restrict access to the `/Admin/edit symptom.php` file.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** An issue exists in the file `/drug recommender/Admin/edit user.php` where improper handling of the `ID` argument allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database. **Recommendations** Update SourceCodester Drug Recommendation System version 1.0 to a version that addresses this issue. As a temporary mitigation, restrict access to the `/drug recommender/Admin/edit user.php` file.

**Name of the Vulnerable Software and Affected Versions** code-projects Matrimonial System version 1.0 **Description** A remote SQL injection exists in the `/partner preference.php` file. The issue occurs within the `writepartnerprefs()` function when the `education` variable is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** As a temporary workaround, restrict access to the `/partner preference.php` file or avoid using the `education` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Drug Recommendation System version 1.0 **Description** An issue exists in the processing of the file `/db/drug recommendor.sql` that allows for remote information disclosure through manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Matrimonial System version 1.0 **Description** An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the `sex`, `mothertongue`, `maritialstatus`, `country`, `state`, `religion`, `agemin`, and `agemax` arguments. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update code-projects Matrimonial System version 1.0 to a patched version. Disable the affected search functionality as a temporary mitigation measure.