CVE-2025-63710 Details
Description
The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implement any CSRF-protection mechanisms such as tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page that, when visited by an authenticated user, will automatically submit a forged POST request to the vulnerable endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized actions on their behalf, such as sending arbitrary messages in any chat room.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the send_message.php endpoint of SourceCodester Simple Public Chat Room version 1.0. The application lacks CSRF protection mechanisms, such as tokens or same-site cookie restrictions. This vulnerability allows an attacker to create a malicious HTML page that, when visited by an authenticated user, automatically submits a forged POST request to the chat message submission endpoint. The request is executed with the user's privileges, enabling the attacker to send arbitrary messages in any chat room on behalf of the victim.
To address this vulnerability, implement anti-CSRF tokens for all state-changing POST endpoints and validate them on the server side. Additionally, apply SameSite cookie attributes, set HttpOnly and Secure flags on session cookies, and enforce server-side authorization checks for message-sending actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63710/README2.md | [email protected] | ExploitMitigationThird Party Advisory |
| https://www.sourcecodester.com/php/12295/simple-public-chat-room-using-php.html | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pijey simple public chat room | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 17, 2025 | Initial Analysis | [email protected] |
| Nov 12, 2025 | CVE Modified | CISA-ADP |
| Nov 10, 2025 | New CVE Received | [email protected] |