CVE-2018-25382

Vulnerability

Zechat 1.5 (vendor Bylancer) contains a SQL injection vulnerability in the profile.php script. The uname GET parameter is not sanitized before being used in a database query, allowing an attacker to inject arbitrary SQL. The vulnerability is present in version 1.5 and possibly earlier versions. [1][2][3]

Exploitation

An unauthenticated attacker can send a crafted HTTP GET request to profile.php with a malicious uname parameter. The provided exploit uses a UNION-based SQL injection payload to extract data from the information_schema database. No authentication or special privileges are required. The attack is straightforward and can be performed remotely. [2]

Impact

Successful exploitation allows an attacker to retrieve sensitive database information, including table names, column names, and user data. This can lead to disclosure of credentials, personal information, or other confidential data stored in the database. The impact is high due to the potential for data exfiltration. [2][3]

Mitigation

As of the available references, no official patch has been released. The vendor (Bylancer) has not provided a fixed version. Users should consider upgrading to a newer version if available, or implement input validation and parameterized queries to prevent SQL injection. The vulnerability is listed in the Exploit Database (EDB-ID 45523) but not in the CISA KEV. [2][3]