CVE-2025-7950 Details

A critical SQL injection vulnerability has been identified in the Public Chat Room project version 1.0, specifically within the login.php file. The issue arises because the application directly concatenates user-supplied input from the 'username' parameter into SQL queries without proper escaping or parameterization. This flaw allows attackers to inject malicious SQL statements, potentially bypassing authentication and manipulating or extracting sensitive information from the database. Notably, this vulnerability can be exploited remotely without any authentication.

It is recommended to use prepared statements and parameter binding to handle user input in SQL queries, ensuring that input is properly sanitized and not directly embedded into query strings. Additionally, input validation and filtering should be implemented to enforce expected data formats.