The Simple Chat System 1.0 from code-projects contains an SQL injection vulnerability in the sendMessage.php file. This vulnerability arises from improper validation of the type, length, or business logic of input parameters, allowing an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely and does not require user interaction, increasing the risk of exploitation. However, the overall impact is rated medium due to the low complexity and limited scope indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider applying application-level input validation and employing web application firewalls to detect and block SQL injection attempts targeting sendMessage.php.