Executive brief
Simple ChatBox, a web-based chat application, contains a security flaw that could allow an attacker to interfere with its database. By sending a specially crafted message, an unauthorized user can potentially view, modify, or delete sensitive information stored by the application. This could lead to data theft or a complete disruption of the chat service.
Technical details
A SQL injection vulnerability exists in code-projects Simple ChatBox version 1.0. The flaw is located in the 'Endpoint' component within the file /chatbox/insert.php. Specifically, the application fails to properly sanitize the 'msg' argument before using it in a SQL query. A remote, unauthenticated attacker can exploit this by sending a malicious payload via the 'msg' parameter, leading to unauthorized database access, data exfiltration, or modification. Public exploit code has been disclosed, increasing the risk of exploitation.
Affected products
- code-projects Simple ChatBox 1.0
Timeline
- 2026-04-13: disclosed: Vulnerability disclosed and CVE assigned.
- 2026-04-13: advisory: NVD and VulDB published the advisory.