# CVE-2018-25339: Bylancer Zechat SQL injection in v parameter

Source: https://junglewise.ai/threats/cve-2018-25339-bylancer-zechat-sql-injection-in-v-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2018-25339 · Severity: high · CVSS 8.2 · Published 2026-05-17

Zechat, a PHP-based chat application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can bypass security controls to extract sensitive information such as user credentials or private communications. This could lead to a total compromise of user data and unauthorized access to the application's administrative functions.

Technologies: [Bylancer Zechat](https://junglewise.ai/threats/technologies/zechat). Vendors: [Bylancer](https://junglewise.ai/threats/vendors/bylancer).

## Quick answers

**Is CVE-2018-25339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25339 being exploited in the wild.

**How severe is CVE-2018-25339?** High severity, with a CVSS score of 8.2, published 17 May 2026.

**Which products and versions are affected?** Bylancer Zechat 1.5.

**Is there a fix for CVE-2018-25339?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25339 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25339?** Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Zechat 1.5 within the 'v' parameter of the 'me' action (e.g., /chat/me?action=edit&v=). The flaw is caused by improper neutralization of special elements in SQL commands, allowing for time-based blind injection. An unauthenticated remote attacker can exploit this by sending requests containing sleep-based payloads to confirm the vulnerability and exfiltrate data from the database bit-by-bit. Additionally, related research indicates the 'hashtag' parameter is also vulnerable to union-based SQL injection. No official patch has been confirmed for this legacy version.

## Affected products

- Bylancer Zechat 1.5

## Timeline

- 2018-05-22: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-17: advisory: CVE record published/updated in NVD dataset

## References

- [https://bylancer.com/](https://bylancer.com/)
- [https://www.exploit-db.com/exploits/44685](https://www.exploit-db.com/exploits/44685)
- [https://www.vulncheck.com/advisories/zechat-sql-injection-via-v-parameter-time-based-blind](https://www.vulncheck.com/advisories/zechat-sql-injection-via-v-parameter-time-based-blind)

## Related threats

- [Bylancer Zechat SQL injection in profile.php](https://junglewise.ai/threats/cve-2018-25382-bylancer-zechat-sql-injection-in-profile-php)
- [Bylancer Zechat SQL injection in hashtag parameter](https://junglewise.ai/threats/cve-2018-25338-bylancer-zechat-sql-injection-in-hashtag-parameter)
- [Bylancer Zechat CSRF in hashtag parameter](https://junglewise.ai/threats/cve-2018-25334-bylancer-zechat-csrf-in-hashtag-parameter)