A remote, unauthenticated SQL injection vulnerability in code-projects Public Chat Room 1.0 poses a significant risk to application integrity and data confidentiality.

This is a SQL injection vulnerability (CWE-89) occurring within the /login.php endpoint. An unauthenticated attacker can supply malicious input via the Username parameter to execute arbitrary database queries.

The CVSS score of 7.3 classifies this as a High severity vulnerability. Successful exploitation could allow an attacker to bypass authentication, extract sensitive user information from the database, or potentially modify application data, leading to severe reputational damage and loss of user trust.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the application or disable the Public Chat Room service until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for anomalous patterns in the Username field, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious payloads targeting the login.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up at https://github.com/BalanceLee/CVE/issues/5.

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability presents an immediate risk to any deployment of Public Chat Room 1.0. Organizations must prioritize isolating the affected component from the network or implementing robust WAF rules to prevent unauthorized database access. Continued monitoring for vendor updates is essential to ensure a permanent resolution is applied as soon as it becomes available.