Executive brief
Simple ChatBox is a PHP-based application used to provide real-time messaging functionality on websites. A security vulnerability in the message handling component allows an attacker to inject malicious scripts into the chat interface. If a user views the compromised chat, the script could execute in their browser, potentially leading to unauthorized actions or the theft of session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Simple ChatBox version 1.0. The flaw is located in the /chatbox/insert.php endpoint, which processes user-supplied input via the 'msg' GET parameter. The application fails to properly sanitize or encode this input before storing it and subsequently displaying it to other users in the chat interface. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing malicious JavaScript. When other users view the chat, the script executes in their browser context. Public exploit details have been disclosed.
Affected products
- code-projects Simple ChatBox 1.0
Timeline
- 2026-04-13: disclosed: Vulnerability disclosed and CVE assigned
- 2026-04-13: advisory: NVD publication date