An unauthenticated SQL injection vulnerability in Code-Projects Simple ChatBox 1.0 allows remote attackers to execute arbitrary database queries and potentially compromise backend data.

The application fails to sanitize the msg parameter within the /chatbox/insert.php endpoint before passing it to backend SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands, enabling time-based blind SQL injection.

Successful exploitation grants an attacker the ability to interact directly with the underlying database. This can lead to unauthorized data exfiltration, modification or deletion of chat records, and potential full compromise of the database management system. Given the CVSS score of 7.3, this represents a high-severity risk to confidentiality and integrity that should be addressed immediately.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /chatbox/insert.php endpoint or disable the affected chat functionality until a secure update is released by the vendor.

Proactive Monitoring: Review database and web server access logs for anomalous POST requests to the chatbox directory, specifically searching for SQL syntax characters such as single quotes, sleep commands, or union select statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the msg parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in a security research write-up on GitHub.

The presence of a functional proof-of-concept for this SQL injection vulnerability creates a significant risk of unauthorized data access. Users are strongly advised to limit exposure by restricting network access to the application and implementing strict WAF filtering. If the software cannot be secured through these compensating controls, it should be removed from production environments until the vendor provides a patched version that utilizes prepared statements.