CVE-2025-63710: SourceCodester Simple Public Chat Room · Cross-Site Request Forgery (CSRF)
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-63710, organizations should implement robust CSRF protections in the SourceCodester Simple Public Chat Room application. This includes integrating anti-CSRF tokens or nonces in all state-changing requests, especially POST requests to send_message.php. Enforcing the SameSite attribute on session cookies (preferably 'Strict' or 'Lax') will help prevent cookies from being sent with cross-site requests. Validating the Origin and Referer headers on incoming requests can provide additional verification that requests originate from trusted sources. If possible, upgrading to a patched version of the software or applying vendor-provided fixes is recommended once available. In the interim, restricting access to the chat application via network segmentation or VPNs can reduce exposure. User education to avoid clicking suspicious links and monitoring chat logs for unusual message patterns can help detect exploitation attempts. Implementing Content Security Policy (CSP) headers may also reduce the risk of malicious script execution that could facilitate CSRF attacks.
Description
The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implement any CSRF-protection mechanisms such as tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page that, when visited by an authenticated user, will automatically submit a forged POST request to the vulnerable endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized actions on their behalf, such as sending arbitrary messages in any chat room.