ITSourcecode Simple ChatBox SQL Injection Vulnerability in message.php

A SQL injection vulnerability has been identified in ITSourcecode Simple ChatBox versions prior to 1.0. The issue resides in the file message.php, where improper handling of user input allows attackers to manipulate SQL queries and potentially access sensitive data.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, log in as an admin user and send a message through the chatbox application. Include a crafted SQL payload in the 'rece' parameter that exploits the SQL injection vulnerability, such as one that causes a delay (e.g., using the 'sleep' function) to demonstrate the injection.