Executive brief
Zechat, a PHP-based chat script, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted requests, an attacker can steal sensitive information such as user credentials, table structures, and other private data. This could lead to a total compromise of the chat platform's data and user privacy.
Technical details
A UNION-based SQL injection vulnerability exists in Zechat version 1.5 and earlier within the 'profile.php' component. The flaw is rooted in the improper neutralization of the 'uname' parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. By supplying crafted payloads, an attacker can bypass authentication and query the 'information_schema' database to retrieve table names, column names, and sensitive record data. This vulnerability was publicly documented via Exploit-DB (45523) and carries a high severity due to the lack of required privileges for exploitation.
Affected products
- Bylancer Zechat 1.5 and earlier
Timeline
- 2018-10-03: disclosed: Original exploit published on Exploit-DB
- 2026-05-29: advisory: CVE published/updated by VulnCheck and NVD