SendMessage.php in code‑projects Simple Chat System 1.0 handles user-supplied message parameters without proper validation, allowing attackers to inject arbitrary SQL. This flaw is identified by CWE‑74 and CWE‑89 and can lead to unauthorized reading or modification of chat logs and user data. The exploit is publicly available, and attackers can target the vulnerability remotely via standard web requests to the sendMessage endpoint. Based on the description, it is inferred that the vulnerable endpoint does not require authentication, enabling attackers to exploit it remotely via standard HTTP methods.

The affected product is code‑projects Simple Chat System 1.0. The flaw resides in the sendMessage.php file that processes chat messaging. No patched version is currently listed by the CNA, so all installations of version 1.0 are potentially vulnerable. The product's CPE is cpe:2.3:a:code-projects:simple_chat_system:*:*:*:*:*:*:*.*

The CVSS score of 5.3 indicates a medium severity impact. Because EPSS is not reported and the vulnerability is not in CISA KEV, the widespread exploitation evidence is limited, though public proof‑of‑concept code exists. Attackers can achieve remote database compromise, compromising confidentiality and integrity of stored messages and user accounts. The risk is moderate but the flaw is certainly exploitable by anyone with network access.