The Simple Chat System 1.0 by code-projects contains an SQL injection vulnerability in the sendMessage.php file. This flaw arises from inadequate validation of certain input parameters, enabling an attacker to inject malicious SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although the exploit is publicly known, no official fix or patch has been documented as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to manipulate the backend database via SQL injection, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no privilege escalation or user interaction is required. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitor vendor communications for updates regarding patches or official remediation.