EUVD-2026-21854
GHSA-658j-rfvq-5wqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /chatbox/insert.php endpoint
-
DeliveryInject SQL syntax into msg parameter
-
ExploitDatabase processes malicious query directly
-
ExecutionAttacker exfiltrates or modifies database contents
-
ImpactCompromise chat data confidentiality and integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible attack requiring no privileges and no user interaction, with low attack complexity. The CVSS score of 6.9 reflects low confidentiality, integrity, and availability impact in the base metrics (VC:L/VI:L/VA:L), suggesting the vulnerability allows data exfiltration and modification but not full system compromise. However, the presence of publicly available exploit code (POC marked as available) significantly elevates practical risk beyond the base score. The E:P environmental factor in the vector indicates publicly available exploit proof-of-concept, which correlates with the VulDB disclosure. This represents a moderate-to-high real-world priority for organizations running Simple ChatBox, particularly internet-facing instances, despite the base CVSS not reaching critical severity. Unauthenticated remote exploitation with no user interaction required makes this straightforward to weaponize against unpatched systems. |
| Exploit ScenarioDerived | An attacker crafts an HTTP request to the /chatbox/insert.php endpoint with a malicious SQL payload embedded in the msg parameter, such as msg=1' OR '1'='1, executing arbitrary SQL queries against the underlying database without authentication. Since the endpoint is network-accessible and requires no user interaction, the attacker can automate enumeration of database structure, exfiltrate sensitive data (user credentials, chat histories), or modify database contents to inject malicious messages or escalate privileges. Publicly available exploit code documented on GitHub (https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Simple%20Chatbox%20PHP%20msg%20Parameter.md) provides ready-to-use attack payloads, lowering the barrier for opportunistic exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in code-projects Simple ChatBox up to version 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via manipulation of the msg parameter in the /chatbox/insert.php endpoint, leading to confidentiality and integrity compromise. The vulnerability has a CVSS score of 6.9 and publicly available exploit code exists, increasing real-world risk despite the moderate base score.
RemediationAI
The primary mitigation is to upgrade Simple ChatBox to a version released after 1.0 if available from the vendor at https://code-projects.org/, or immediately discontinue use of the affected application if no patched version exists. Urgent remediation options include implementing a Web Application Firewall (WAF) with SQL injection signatures to filter malicious msg parameter payloads at the application gateway, applying strict input validation and parameterized query frameworks to the insert.php endpoint, and restricting network access to the /chatbox/insert.php endpoint to trusted IP ranges until patching is possible. Review the VulDB advisory at https://vuldb.com/vuln/357041 for additional mitigation guidance and monitoring signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Simple ChatBox is a PHP-based chat application vulnerable to SQL injection (CWE-89) in the insert.php endpoint handler. The vulnerability stems from insufficient input validation on the msg parameter, allowing attackers to inject malicious SQL syntax directly into database queries. The affected component processes user-supplied message input without proper parameterized queries or escaping, a common flaw in legacy PHP applications that directly concatenate user input into SQL statements. The CPE cpe:2.3:a:code-projects:simple_chatbox:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the application, with explicit confirmation through version 1.0.
Know when Simple Chatbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in code-projects Simple ChatBox Injection Vulnerabilities
View all 2More in Simple Chatbox
View allA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. Rated high severity (CVSS 7.2), this vulnerability i
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. Rated medium severity (CVSS 6.4), this vulnerability
Remote file and directory information exposure in code-projects Simple ChatBox 1.0 allows unauthenticated attackers to d
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. Rated low severity (CVSS 3.8), this vulnerability is
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. Rated low severity (CVSS 3.8), this vulnerability is
Exploit-DB