Is CVE-2018-25382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25382 being exploited in the wild.

How severe is CVE-2018-25382?

High severity, with a CVSS score of 8.2, published 29 May 2026.

Which products and versions are affected?

Bylancer Zechat 1.5 and earlier.

Is there a fix for CVE-2018-25382?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25382 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25382?

Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25382: Bylancer Zechat SQL injection in profile.php

CVE-2018-25382 · Severity: high · CVSS 8.2 · Published 2026-05-29

Zechat, a PHP-based chat script, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted requests, an attacker can steal sensitive information such as user credentials, table structures, and other private data. This could lead to a total compromise of the chat platform's data and user privacy.

Technologies: Bylancer Zechat. Vendors: Bylancer.

Quick answers

Is CVE-2018-25382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25382 being exploited in the wild.
How severe is CVE-2018-25382?: High severity, with a CVSS score of 8.2, published 29 May 2026.
Which products and versions are affected?: Bylancer Zechat 1.5 and earlier.
Is there a fix for CVE-2018-25382?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25382 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25382?: Check whether you run Bylancer Zechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A UNION-based SQL injection vulnerability exists in Zechat version 1.5 and earlier within the 'profile.php' component. The flaw is rooted in the improper neutralization of the 'uname' parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. By supplying crafted payloads, an attacker can bypass authentication and query the 'information_schema' database to retrieve table names, column names, and sensitive record data. This vulnerability was publicly documented via Exploit-DB (45523) and carries a high severity due to the lack of required privileges for exploitation.

Affected products

Bylancer Zechat 1.5 and earlier

Timeline

2018-10-03: disclosed: Original exploit published on Exploit-DB
2026-05-29: advisory: CVE published/updated by VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.