Is CVE-2018-25338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25338 being exploited in the wild.

How severe is CVE-2018-25338?

High severity, with a CVSS score of 8.2, published 17 May 2026.

Which products and versions are affected?

Bylancer Zechat 1.5 and earlier.

Is there a fix for CVE-2018-25338?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25338 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25338?

Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25338: Bylancer Zechat SQL injection in hashtag parameter

CVE-2018-25338 · Severity: high · CVSS 8.2 · Published 2026-05-17

Zechat, a PHP-based web chat application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can steal sensitive information such as user details, table structures, and other private data. This could lead to a total compromise of the application's data and potentially impact user privacy and business operations.

Technologies: Bylancer Zechat. Vendors: Bylancer.

Quick answers

Is CVE-2018-25338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25338 being exploited in the wild.
How severe is CVE-2018-25338?: High severity, with a CVSS score of 8.2, published 17 May 2026.
Which products and versions are affected?: Bylancer Zechat 1.5 and earlier.
Is there a fix for CVE-2018-25338?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25338 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25338?: Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in Zechat version 1.5 (and potentially earlier) within the 'hashtag' parameter of the /chat/hashtag endpoint. The application fails to properly neutralize special elements in the user-supplied input, allowing for unauthenticated, union-based SQL injection attacks. An attacker can leverage this to retrieve sensitive schema information, including table and column names, from the database. Additionally, the 'v' parameter in the /chat/me endpoint is reported to be vulnerable to time-based blind SQL injection. No official patch is currently documented in the advisory.

Affected products

Bylancer Zechat 1.5 and earlier

Timeline

2018-05-22: disclosed: Initial exploit code published on Exploit-DB
2026-05-17: advisory: NVD and VulnCheck published formal advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.