Executive brief
Simple ChatBox, a PHP-based messaging application, contains a security flaw that exposes its database backup file to the public internet. An unauthorized person can download the application's database schema and chat history, potentially leading to the exposure of private conversations and system configuration details. This could result in a loss of privacy for users and provide attackers with information needed for further attacks.
Technical details
Simple ChatBox 1.0 is vulnerable to sensitive information disclosure (CWE-200/CWE-538) because it stores a database dump file, chatbox.sql, within a publicly accessible web directory. The file is located at /chatbox/database/chatbox.sql and is not protected by server-side access controls or authentication requirements. A remote, unauthenticated attacker can download this file via a direct HTTP request to retrieve the full database schema, chat messages, and user data. This issue stems from a security misconfiguration where sensitive development or backup artifacts are left in the production web root. A public exploit exists in the form of direct URL access to the backup file.
Affected products
- code-projects Simple ChatBox 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment