Is there a public PoC exploit available for CVE-2025-8164?

Yes, a public proof-of-concept exploit is available for CVE-2025-8164. Prioritise patching immediately. EPSS: 0.1%.

Public Chat Room CVE-2025-8164

Q: What is the CVSS score of CVE-2025-8164?

CVE-2025-8164 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-25 cna@vuldb.com

PHP SQLi Public Chat Room Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:30 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_message.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Public Chat Room 1.0 via the ID parameter in send_message.php allows authenticated remote attackers to execute arbitrary SQL queries, despite a low CVSS 4.0 score of 2.1. The vulnerability requires prior authentication (PR:L) and offers only limited confidentiality impact (VC:L/VI:L/VA:L), but publicly available exploit code exists and the attack vector is network-accessible with low complexity, making it suitable for low-friction post-compromise lateral movement or information disclosure within authenticated environments.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly manifesting as SQL injection) in PHP code. The send_message.php script fails to sanitize or parameterize the ID parameter before incorporating it into SQL queries. This allows an attacker who has already authenticated to the application to craft malicious SQL statements that execute with the privileges of the database connection. The PHP application likely uses unescaped string concatenation or inadequate input validation, permitting attackers to break out of intended SQL syntax and inject commands to read, modify, or exfiltrate database contents.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate remediation requires parameterized queries (prepared statements with bound parameters) in send_message.php to neutralize SQL injection. Replace all direct string concatenation in SQL statements with parameterized query syntax (e.g., using PHP PDO with placeholders or mysqli prepared statements). As a compensating control, implement strict input validation on the ID parameter to accept only alphanumeric characters or numeric values expected for message identifiers, rejecting any inputs containing SQL metacharacters (quotes, semicolons, dashes, parentheses); this reduces but does not eliminate risk. Consider implementing a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in the ID parameter (e.g., OWASP ModSecurity rules for SQL injection detection), though this cannot replace code-level fixes. Restrict database user privileges: ensure the PHP application connects to the database with a limited account that has only SELECT/INSERT/UPDATE privileges on necessary tables, not administrative rights, limiting blast radius if injection succeeds. Users unable to patch immediately should disable or restrict access to the chat functionality if operationally feasible, or implement IP whitelisting to limit which authenticated users can access send_message.php.