# CVE-2018-25338: Bylancer Zechat SQL injection in hashtag parameter

Source: https://junglewise.ai/threats/cve-2018-25338-bylancer-zechat-sql-injection-in-hashtag-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2018-25338 · Severity: high · CVSS 8.2 · Published 2026-05-17

Zechat, a PHP-based web chat application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can steal sensitive information such as user details, table structures, and other private data. This could lead to a total compromise of the application's data and potentially impact user privacy and business operations.

Technologies: [Bylancer Zechat](https://junglewise.ai/threats/technologies/zechat). Vendors: [Bylancer](https://junglewise.ai/threats/vendors/bylancer).

## Quick answers

**Is CVE-2018-25338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25338 being exploited in the wild.

**How severe is CVE-2018-25338?** High severity, with a CVSS score of 8.2, published 17 May 2026.

**Which products and versions are affected?** Bylancer Zechat 1.5 and earlier.

**Is there a fix for CVE-2018-25338?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25338 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25338?** Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Zechat version 1.5 (and potentially earlier) within the 'hashtag' parameter of the /chat/hashtag endpoint. The application fails to properly neutralize special elements in the user-supplied input, allowing for unauthenticated, union-based SQL injection attacks. An attacker can leverage this to retrieve sensitive schema information, including table and column names, from the database. Additionally, the 'v' parameter in the /chat/me endpoint is reported to be vulnerable to time-based blind SQL injection. No official patch is currently documented in the advisory.

## Affected products

- Bylancer Zechat 1.5 and earlier

## Timeline

- 2018-05-22: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-17: advisory: NVD and VulnCheck published formal advisory details

## References

- [https://bylancer.com/](https://bylancer.com/)
- [https://www.exploit-db.com/exploits/44685](https://www.exploit-db.com/exploits/44685)
- [https://www.vulncheck.com/advisories/zechat-sql-injection-via-hashtag-parameter](https://www.vulncheck.com/advisories/zechat-sql-injection-via-hashtag-parameter)

## Related threats

- [Bylancer Zechat SQL injection in profile.php](https://junglewise.ai/threats/cve-2018-25382-bylancer-zechat-sql-injection-in-profile-php)
- [Bylancer Zechat SQL injection in v parameter](https://junglewise.ai/threats/cve-2018-25339-bylancer-zechat-sql-injection-in-v-parameter)
- [Bylancer Zechat CSRF in hashtag parameter](https://junglewise.ai/threats/cve-2018-25334-bylancer-zechat-csrf-in-hashtag-parameter)