vendor:
Zechat
by:
Ihsan Sencan
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Zechat
Affected Version From: 1.5
Affected Version To: 1.5
Patch Exists: NO
Related CWE: N/A
CPE: a:bylancer:zechat
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2018
Zechat 1.5 – ‘uname’ SQL Injection
Zechat 1.5 is vulnerable to SQL Injection. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to the database and execute arbitrary SQL commands. The attacker can also use the 'uname' parameter to inject malicious SQL code into the application. The attacker can then use the make_set() function to extract data from the database.
Mitigation:
The application should validate user input and sanitize it before passing it to the database. The application should also use parameterized queries to prevent SQL injection.
