CVE-2025-0172

CVE-2025-0172 is a critical SQL injection vulnerability in code-projects Chat System 1.0, affecting an unknown functionality within the /admin/deleteroom.php file. The issue arises from improper handling of the 'id' argument, allowing manipulation that leads to SQL injection. It is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-01-02.

The vulnerability can be exploited remotely by low-privileged users (PR:L), such as authenticated administrators, over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing attackers to extract sensitive data, modify chat room records, or disrupt service through injected SQL payloads.

Advisories and references, including those from VulDB (ctiid.289939, id.289939, submit.473153) and a GitHub proof-of-concept at github.com/Sinon2003/cve/blob/main/chatsystem/sql_inject2.md, confirm the remote exploitability. The exploit has been publicly disclosed and may be actively used, though no specific patches or mitigation steps are detailed in the available information; practitioners should review the code-projects.org site and referenced materials for updates or workarounds.