Zechat 1.5 contains a classic SQL injection flaw in the hashtag parameter that enables attackers to execute union-based payloads and retrieve internal database structure such as table and column names. The vulnerability is a clear instance of CWE-89 and grants unauthorized read access to sensitive data, thereby breaching confidentiality of the application’s data store.

The affected product is Zechat, version 1.5, distributed by Bylancer. No additional product variants or later versions are listed in the CNA data, so the scope is limited to this specific release.

The CVSS score of 8.8 indicates a severe risk, and the EPSS score is not available, so the likelihood of exploitation is uncertain; the vulnerability is not listed in the CISA KEV catalog. Attackers can perform the exploit without authentication by supplying crafted payloads to the hashtag input field, which is exposed to unauthenticated traffic. Evidence of this is explicitly stated in the description, while the precise network exposure is inferred from the mention of a web parameter.