The vulnerability in CodePhiliaX Chat2DB, located in DMDBManage.java, allows an attacker to perform SQL injection through several export functions. The flaw permits remote manipulation of the SQL statements that the application constructs, potentially enabling the attacker to read, modify, or delete data stored in the database. This leads to a compromise of the confidentiality and integrity of database contents, and if exploited with higher privileges, could facilitate further escalation or denial‑of‑service conditions.

CodePhiliaX:Chat2DB versions up to 0.3.7 are affected. The vulnerability resides in the Database Export Handler component, specifically the files DMDBManage.java and functions exportTable, exportTableColumnComment, exportView, exportProcedure, exportTriggers, exportTrigger, and updateProcedure.

The CVSS score of 5.3 indicates a moderate severity, but the EPSS score of less than 1% shows that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; attackers can trigger the injection by accessing the exported actions via HTTP requests to the application. Although an exploit has been published, no official fix or patch is currently available, underscoring the need to mitigate the risk through available controls.