PT-2026-41565 · Zechat · Zechat

Published 2026-05-17 · Updated 2026-05-17 · CVE-2018-25339

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zechat version 1.5

Description An issue exists where unauthenticated attackers can extract database information using time-based blind techniques. This is achieved by exploiting the v parameter with sleep-based blind injection, which allows the attacker to confirm the flaw and retrieve data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25339

Affected Products

Zechat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25339 · Security Note
• https://t.me/CVEtracker/54064 · Telegram Post
• https://bylancer.com · Note
• https://exploit-db.com/exploits/44685 · Note
• https://vulncheck.com/advisories/zechat-sql-injection-via-v-parameter-time-based-blind · Note