Executive brief
Zechat, a PHP-based web chat application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can steal sensitive information such as user details, table structures, and other private data. This could lead to a total compromise of the application's data and potentially impact user privacy and business operations.
Technical details
A SQL injection vulnerability exists in Zechat version 1.5 (and potentially earlier) within the 'hashtag' parameter of the /chat/hashtag endpoint. The application fails to properly neutralize special elements in the user-supplied input, allowing for unauthenticated, union-based SQL injection attacks. An attacker can leverage this to retrieve sensitive schema information, including table and column names, from the database. Additionally, the 'v' parameter in the /chat/me endpoint is reported to be vulnerable to time-based blind SQL injection. No official patch is currently documented in the advisory.
Affected products
- Bylancer Zechat 1.5 and earlier
Timeline
- 2018-05-22: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-17: advisory: NVD and VulnCheck published formal advisory details