PT-2025-46161 · Sourcecodester · Simple Public Chat Room

Published 2025-11-10 · Updated 2025-11-10 · CVE-2025-63710

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Public Chat Room version 1.0

Description The application lacks CSRF-protection mechanisms like tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page that, when visited by an authenticated user, will automatically submit a forged POST request to the ''send message.php'' endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized actions, such as sending arbitrary messages in any chat room. The vulnerable parameter is not specified.

Recommendations Implement CSRF-protection mechanisms, such as tokens, nonces, or same-site cookie restrictions.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-63710

Affected Products

Simple Public Chat Room

References · 7

• 🔥 https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63710/README2.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-63710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63710 · Security Note
• https://twitter.com/CVEnew/status/1987896593450782863 · Twitter Post
• https://t.me/CVEtracker/36922 · Telegram Post
• https://sourcecodester.com/php/12295/simple-public-chat-room-using-php.html · Note
• https://twitter.com/VulmonFeeds/status/1987942844942655508 · Twitter Post