A critical SQL injection vulnerability in phpMyChat Plus 1.98 allows unauthenticated remote attackers to compromise database contents.

The application fails to properly sanitize user input in the pmc_username parameter within the deluser.php script. This flaw allows an unauthenticated attacker to inject malicious SQL queries, facilitating boolean-based, error-based, and time-based blind data extraction.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may contain sensitive user credentials, personal information, or session data. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality and integrity, potentially leading to total database compromise or service disruption.

Immediate Action: As no official patch is currently identified, users should restrict access to the deluser.php endpoint or disable the affected module entirely until a vendor-supplied update is available.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous SQL syntax, such as UNION SELECT statements, SLEEP commands, or unexpected database error messages originating from the deluser.php page.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting POST requests to the deluser.php file.

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via ExploitDB (EDB-ID 48066).

Given the availability of public exploit code and the critical nature of SQL injection, this vulnerability poses a severe threat to any environment hosting phpMyChat Plus. Administrators must prioritize limiting access to this application and implementing robust WAF filtering immediately to prevent unauthorized data exfiltration.