A vulnerability has been found in code-projects Chat System 1

CVE-2025-0172 is an SQL injection in code-projects Chat System 1.0 inside /admin/deleteroom.php, where the id POST parameter is inserted into multiple DELETE queries without sanitization or parameterization. The public PoC shows a time-based blind payload against an authenticated session cookie, which means the issue is reachable over HTTP but only after the attacker can talk to the admin-side workflow. Affected versioning is narrow from what is publicly documented: Chat System 1.0; I found no authoritative vendor-fixed release.

The vendor's MEDIUM 6.3 is directionally closer to reality than the NVD's later 7.5 reinterpretation, but even 6.3 still overstates enterprise urgency once you account for real-world friction. This is a niche educational PHP/XAMPP app, not a common enterprise platform; the vulnerable endpoint lives under /admin/; and the exploit path assumes prior access plus a valid session. So yes, patch or retire it if you actually run it—but no, this should not outrank externally exposed pre-auth RCEs or mass-exploited edge bugs.

Why this verdict

• Start from 6.3, then subtract for attacker position: the best-supported path requires a valid session and reaches an /admin/ endpoint, which implies prior compromise, credential theft, or legitimate access before the CVE becomes usable.
• Subtract again for exposed population: code-projects Chat System is a free educational PHP/XAMPP package, so the fraction of real enterprise estates running it in production is tiny compared with mainstream SaaS, VPN, email, or edge software.
• Do not add an exploitation premium: there is a public PoC, but no KEV listing, no cited campaign use, and EPSS is very low. Public code makes validation easy; it does not by itself make this a top-of-queue fleet emergency.

Why not higher?

If this were pre-auth on a user-facing route or a common enterprise product, the score would climb fast. But authenticated/admin-side reachability, uncertain role enforcement, and very low likely deployment scale compound downward pressure at every step of the chain.

Why not lower?

This is still genuine SQL injection, not a theoretical lint finding. If the app exists and the attacker can hit the endpoint, they can likely alter or extract application data, and the PoC means defenders should assume low-skill operators can reproduce it.

1. Fence off /admin/ — Put the admin path behind VPN, SSO, or IP allowlists so random internet traffic never reaches the vulnerable function. For a LOW verdict there is no mitigation SLA; treat this as backlog hygiene unless the app is externally exposed, in which case it is a cheap immediate hardening win.
2. Retire or quarantine demo deployments — If this is a lab, student, or forgotten business-side upload, remove it from production or isolate it on a non-routable segment. With no vendor-fixed version identified, retirement is often cleaner than carrying bespoke code debt; for LOW, handle it as normal backlog hygiene.
3. Add a targeted WAF rule — Block suspicious SQL metacharacters and anomalous POSTs to /admin/deleteroom.php, especially payloads using quotes, comments, and timing functions. This is a compensating control, not a cure, and for LOW severity it can be rolled out during routine tuning rather than under an emergency deadline.
4. Reduce DB account rights — Make sure the app's MySQL account cannot do more than the application strictly needs; this cuts the damage ceiling if the injection is exploited. For LOW, there is no formal mitigation clock, but least privilege belongs in your normal hardening backlog.

Run this on the target web server or a source checkout that contains the application files. Invoke it as python3 verify_cve_2025_0172.py /var/www/html/chat-system or point it directly at admin/deleteroom.php; it only needs read access to the code, not root.

#!/usr/bin/env python3
# verify_cve_2025_0172.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
from pathlib import Path

VULN_FILE = os.path.join('admin', 'deleteroom.php')


def load_target(path_str):
    p = Path(path_str)
    if not p.exists():
        return None, 'target path does not exist'
    if p.is_dir():
        target = p / VULN_FILE
        if not target.exists():
            return None, f'could not find {VULN_FILE} under directory'
        return target, None
    return p, None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_cve_2025_0172.py <app_dir_or_deleteroom.php>')
        sys.exit(2)

    target, err = load_target(sys.argv[1])
    if err:
        print(f'UNKNOWN - {err}')
        sys.exit(2)

    try:
        data = target.read_text(encoding='utf-8', errors='ignore')
    except Exception as e:
        print(f'UNKNOWN - failed to read {target}: {e}')
        sys.exit(2)

    # Strong indicators of the published vulnerable code path
    has_post_id = re.search(r"\$_POST\s*\[\s*['\"]id['\"]\s*\]", data) is not None
    assigns_id = re.search(r"\$id\s*=\s*\$_POST\s*\[\s*['\"]id['\"]\s*\]", data) is not None
    raw_delete_chatroom = re.search(r"delete\s+from\s+`?chatroom`?\s+where\s+chatroomid\s*=\s*'\$id'", data, re.IGNORECASE) is not None
    raw_delete_chat = re.search(r"delete\s+from\s+`?chat`?\s+where\s+chatroomid\s*=\s*'\$id'", data, re.IGNORECASE) is not None
    raw_delete_member = re.search(r"delete\s+from\s+`?chat_member`?\s+where\s+chatroomid\s*=\s*'\$id'", data, re.IGNORECASE) is not None
    uses_mysqli_query = 'mysqli_query' in data

    # Weak indicators of a local fix
    prepared_stmt = any(token in data for token in [
        'prepare(', 'mysqli_prepare(', 'bind_param(', 'PDO->prepare(', '->prepare('
    ])
    numeric_cast = re.search(r"\$id\s*=\s*\(int\)\s*\$_POST\s*\[\s*['\"]id['\"]\s*\]", data) is not None
    ctype_check = 'ctype_digit' in data or 'filter_var($id, FILTER_VALIDATE_INT)' in data

    if has_post_id and assigns_id and uses_mysqli_query and raw_delete_chatroom and raw_delete_chat and raw_delete_member:
        print(f'VULNERABLE - {target} matches the published SQLi pattern for CVE-2025-0172')
        sys.exit(1)

    if prepared_stmt or numeric_cast or ctype_check:
        print(f'PATCHED - {target} does not match the published vulnerable pattern and shows signs of input hardening')
        sys.exit(0)

    print(f'UNKNOWN - {target} was found, but the code does not clearly match either the published vulnerable or patched pattern')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2025-0172
2. Public PoC by Sinon2003
3. code-projects Chat System product page
4. CISA Vulnerability Bulletin SB25-006
5. CISA Known Exploited Vulnerabilities Catalog
6. OpenCVE entry for CVE-2025-0172