A flaw in the Simple ChatBox application allows an attacker to inject arbitrary SQL code via the \\"msg\\" parameter in the \\"insert.php\\" endpoint. The code is incorporated into a database query without proper sanitization, so a crafted request can execute SQL statements beyond the intended scope. This results in potential read or modify access to the underlying database, compromising data confidentiality, integrity, or availability for the affected application. The vulnerability is listed publicly and can be triggered by any network user over HTTP.

The issue affects code-projects Simple ChatBox version 1.0 and prior releases. The attack vector is the publicly exposed \\"/chatbox/insert.php\\" endpoint, which accepts user supplied "msg" data from external users. Any host running this software without a newer patched version remains susceptible.

The Common Vulnerability Scoring System assigns a score of 6.9, indicating a moderate to high severity. An exploit probability metric is not available and the vulnerability is not catalogued by CISA. Because the input can be supplied remotely, the attack requires no special local access or privileged credentials. The exposure is global, making it a legitimate threat for any unpatched installation.