📄 Description (English)
phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to extract sensitive database information by crafting malicious payloads in the username field.
🤖 AI Executive Summary
CVE-2020-37151 is a critical SQL injection vulnerability in phpMyChat Plus 1.98 affecting the deluser.php page through the pmc_username parameter. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to extract sensitive database information and potentially manipulate database queries. With an available exploit and CVSS score of 8.2, this poses an immediate threat to organizations using this outdated chat application for internal communications.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 25, 2026 17:56
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi government agencies, educational institutions, and medium-sized enterprises that may still be using phpMyChat Plus for internal communications. Government entities under NCA oversight and educational institutions are at highest risk. The SQL injection could lead to unauthorized access to employee databases, credential theft, and potential lateral movement within organizational networks. Banking and financial institutions using this application would face severe data breach risks affecting customer information and transaction records.
🏢 Affected Saudi Sectors
Government
Education
Healthcare
Banking
Telecommunications
Medium-sized Enterprises
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.5
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Identify all instances of phpMyChat Plus 1.98 in your environment using network scanning tools
2. Isolate affected systems from production networks if immediate patching is not possible
3. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the deluser.php endpoint
Patching Guidance:
1. Upgrade phpMyChat Plus to version 1.99 or later immediately
2. If upgrade is not immediately feasible, apply vendor security patches
3. Verify patch installation by checking application version and testing deluser.php functionality
Compensating Controls:
1. Implement input validation and parameterized queries at the application level
2. Apply principle of least privilege to database user accounts
3. Enable database query logging and monitoring for suspicious SQL patterns
4. Restrict access to deluser.php to authorized administrators only via IP whitelisting
Detection Rules:
1. Monitor for SQL keywords (UNION, SELECT, OR, AND) in pmc_username parameter
2. Alert on time-based delays in deluser.php requests (SLEEP, BENCHMARK functions)
3. Track failed database queries and authentication attempts
4. Monitor for unusual database user activity and data extraction patterns
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع نسخ phpMyChat Plus 1.98 في بيئتك باستخدام أدوات المسح الشبكي
2. عزل الأنظمة المتأثرة عن شبكات الإنتاج إذا لم يكن التصحيح الفوري ممكناً
3. تطبيق قواعد جدار حماية تطبيقات الويب (WAF) لحجب أنماط حقن SQL في نقطة نهاية deluser.php
إرشادات التصحيح:
1. ترقية phpMyChat Plus إلى الإصدار 1.99 أو أحدث فوراً
2. إذا لم يكن الترقية ممكنة فوراً، طبق تصحيحات الأمان من المورد
3. تحقق من تثبيت التصحيح بفحص إصدار التطبيق واختبار وظيفة deluser.php
الضوابط البديلة:
1. تطبيق التحقق من صحة المدخلات والاستعلامات المعاملة على مستوى التطبيق
2. تطبيق مبدأ أقل امتياز على حسابات مستخدمي قاعدة البيانات
3. تفعيل تسجيل الاستعلامات وراقبة قاعدة البيانات للأنماط المريبة
4. تقييد الوصول إلى deluser.php للمسؤولين المصرح لهم فقط عبر القائمة البيضاء للعناوين
قواعد الكشف:
1. مراقبة كلمات SQL الرئيسية (UNION, SELECT, OR, AND) في معامل pmc_username
2. التنبيه على التأخيرات الزمنية في طلبات deluser.php (وظائف SLEEP, BENCHMARK)
3. تتبع استعلامات قاعدة البيانات الفاشلة ومحاولات المصادقة
4. مراقبة نشاط مستخدم قاعدة البيانات غير العادي وأنماط استخراج البيانات
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.14.2.1 - Secure development policy
A.14.2.5 - Secure development environment
A.12.6.1 - Management of technical vulnerabilities
A.12.2.1 - Monitoring of system use
🔵 SAMA CSF
ID.RA-1 - Asset management and vulnerability identification
PR.DS-6 - Integrity checking mechanisms
DE.CM-1 - The network is monitored for unauthorized connections
RS.MI-2 - Incidents are mitigated
🟡 ISO 27001:2022
A.12.2.1 - Change management procedures
A.12.6.1 - Management of technical vulnerabilities
A.14.2.1 - Secure development policy
A.14.2.5 - Secure development environment
🟣 PCI DSS v4.0.1
6.2 - Ensure security patches are installed
6.5.1 - Injection flaws prevention
11.2 - Vulnerability scanning
🔗 References & Sources 3
🔗
http://ciprianmp.com/latest/
disclosure@vulncheck.com
Product
🔗
https://www.exploit-db.com/exploits/48066
disclosure@vulncheck.com
Exploit
Third Party Advisory
VDB Entry
🔗
https://www.vulncheck.com/advisories/phpmychat-plus-deluserphp-sql-injection
disclosure@vulncheck.com
Broken Link
Third Party Advisory
📦 Affected Products / CPE 1 entries
ciprianmp:phpmychat-plus:1.98