Description
Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bylancer | Zechat | 1.5 | — |
References
- ExploitDB-44685 exploit
- Official Product Homepage product
- VulnCheck Advisory: Zechat 1.5 SQL Injection via hashtag parameter third-party-advisory