PT-2025-35219 · Unknown · Shafhasan Chatbox

Maloyroyorko · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-9651

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions:

shafhasan chatbox versions prior to 156a39cde62f78532c3265a70eda12c70907e56f

Description:

A vulnerability exists in shafhasan chatbox due to SQL injection. The issue is located in the `/chat.php` file and affects an unknown function. Manipulation of the `user id` argument can trigger the vulnerability. The attack can be performed remotely. The exploit has been made public.

Recommendations:

As a temporary workaround, consider restricting access to the `/chat.php` file until a fix is available.

Avoid using the `user id` parameter in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2025-9651

Affected Products

Shafhasan Chatbox

References · 6

• 🔥 https://websecurityinsights.my.id/2025/08/chatbox-10-chatphpuserid-sql-injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9651 · Security Note
• https://vuldb.com/?submit.636884 · Note
• https://twitter.com/CVEnew/status/1961437317182218354 · Twitter Post
• https://vuldb.com/?id.321859 · Note
• https://vuldb.com/?ctiid.321859 · Note