CVE-2020-37151: 
phpMyChat Plus vulnerability analysis and mitigation

CVE-2020-37151 is a SQL injection vulnerability in phpMyChat Plus version 1.98, affecting the deluser.php page via the pmc_username parameter. It allows unauthenticated remote attackers to manipulate database queries using boolean-based, error-based, and time-based blind SQL injection techniques. The vulnerability was formally published on February 5, 2026, and is assigned a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.8 (High) (Feedly, VulnCheck Advisory).

The root cause is improper neutralization of special elements used in SQL commands (CWE-89), where user-supplied input in the pmc_username parameter of deluser.php is not sanitized or parameterized before being incorporated into database queries. An unauthenticated attacker can craft malicious HTTP requests targeting this endpoint, leveraging boolean-based, error-based, and time-based blind SQL injection techniques to enumerate and extract database contents. No authentication or user interaction is required, and the attack is executable remotely over the network. A public exploit is available on Exploit-DB (Exploit-DB, VulnCheck Advisory).

Successful exploitation allows an unauthenticated attacker to extract sensitive information from the underlying database, including user credentials, chat logs, and other stored data, resulting in high confidentiality impact. There is also a low integrity impact, as the SQL injection may allow limited data manipulation. No availability impact is expected based on the vulnerability's nature (Feedly).

A public proof-of-concept exploit is available on Exploit-DB (EDB-ID 48066), lowering the barrier for exploitation. The EPSS score is approximately 0.033%, indicating a low but non-zero probability of exploitation in the wild. No confirmed in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, Feedly).

1. Reconnaissance: Identify internet-facing phpMyChat Plus 1.98 installations by searching for the application's login or admin pages using tools like Shodan or Google dorks.
2. Locate the vulnerable endpoint: Navigate to or send HTTP requests to the deluser.php page on the target server.
3. Inject malicious payload: Supply a crafted SQL injection payload in the pmc_username parameter (e.g., pmc_username=admin' AND SLEEP(5)-- for time-based blind injection, or boolean-based payloads such as admin' AND 1=1--).
4. Extract database information: Use automated tools such as sqlmap targeting the pmc_username parameter to enumerate databases, tables, and extract sensitive data (e.g., sqlmap -u 'http://target/deluser.php' --data='pmc_username=admin' --dbs).
5. Exfiltrate credentials or sensitive data: Dump user tables to obtain plaintext or hashed credentials for further access (Exploit-DB, VulnCheck Advisory).

• Network: Unusual or repeated HTTP POST/GET requests to deluser.php containing SQL metacharacters (e.g., single quotes, AND, OR, SLEEP, BENCHMARK, UNION) in the pmc_username parameter; anomalous response time variations suggesting time-based blind injection.
• Logs: Web server access logs showing requests to deluser.php with encoded or suspicious pmc_username values; database error messages logged from the application.
• Process/Database: Unexpected database queries with conditional logic or sleep functions originating from the web application process; unusual spikes in database query volume or duration.

No official patch from the vendor has been confirmed for phpMyChat Plus 1.98. Recommended mitigations include: implementing input validation and parameterized queries (prepared statements) for the pmc_username parameter; deploying a Web Application Firewall (WAF) to detect and block SQL injection attempts; restricting or disabling access to the deluser.php administrative endpoint where not required; and conducting a database audit to identify any unauthorized access or data exfiltration. Organizations should consider migrating away from this unsupported software if no patch becomes available (VulnCheck Advisory, Feedly).