Executive brief
Zechat, a PHP-based chat application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can bypass security controls to extract sensitive information such as user credentials or private communications. This could lead to a total compromise of user data and unauthorized access to the application's administrative functions.
Technical details
A SQL injection vulnerability exists in Zechat 1.5 within the 'v' parameter of the 'me' action (e.g., /chat/me?action=edit&v=). The flaw is caused by improper neutralization of special elements in SQL commands, allowing for time-based blind injection. An unauthenticated remote attacker can exploit this by sending requests containing sleep-based payloads to confirm the vulnerability and exfiltrate data from the database bit-by-bit. Additionally, related research indicates the 'hashtag' parameter is also vulnerable to union-based SQL injection. No official patch has been confirmed for this legacy version.
Affected products
- Bylancer Zechat 1.5
Timeline
- 2018-05-22: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-17: advisory: CVE record published/updated in NVD dataset