PT-2025-35219 · Unknown · Shafhasan Chatbox

Maloyroyorko · Publicado 2025-08-29 · Atualizado 2025-08-29 · CVE-2025-9651

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions shafhasan chatbox versions prior to 156a39cde62f78532c3265a70eda12c70907e56f

Description A vulnerability exists in shafhasan chatbox due to SQL injection. The issue is located in the /chat.php file and affects an unknown function. Manipulation of the user id argument can trigger the vulnerability. The attack can be performed remotely. The exploit has been made public.

Recommendations As a temporary workaround, consider restricting access to the /chat.php file until a fix is available. Avoid using the user id parameter in the affected file until the issue is resolved.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2025-9651

Produtos afetados

Shafhasan Chatbox

Referências · 7

• 🔥 https://websecurityinsights.my.id/2025/08/chatbox-10-chatphpuserid-sql-injection.html · Exploit
• https://t.me/CVEtracker/31249 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-9651 · Nota de Segurança
• https://twitter.com/CVEnew/status/1961437317182218354 · Publicação no Twitter
• https://vuldb.com/?submit.636884 · Nota
• https://vuldb.com/?ctiid.321859 · Nota
• https://vuldb.com/?id.321859 · Nota