CVE-2018-25382

Zechat 1.5 SQL Injection via uname Parameter

CVSS 8.8 HIGHEPSS 0.3%CWE-89

Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column names, and sensitive data from the information_schema database.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Bylancer · Zechat

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/45523unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bylancer.com/https://bylancer.com/products/zechat-php-script/index.php https://www.exploit-db.com/exploits/45523 https://www.vulncheck.com/advisories/zechat-sql-injection-via-uname-parameter