Zechat 1.5 contains a classic SQL injection flaw in the v request parameter that can be exploited without authentication. By injecting time delay functions such as SLEEP, an attacker can confirm the vulnerability and then slowly retrieve database content, leading to confidential data exposure. This weakness is identified as CWE-89, a typical example of unsanitized user input being incorporated into SQL statements.

The flaw affects Zechat version 1.5, distributed by Bylancer. Customers deploying this specific release are the only ones exposed; newer releases that do not expose the v parameter or have proper sanitization are not impacted.

The vulnerability scores a CVSS of 8.8, indicating high severity. EPSS information is not available, but the lack of a mitigation means the risk remains high. The flaw is not listed in CISA’s KEV catalog yet, but the lack of authentication requirements makes it readily exploitable by any network actor who can reach the vulnerable endpoint. Attackers would target the unprotected v parameter URL, inject time-consuming SQL statements, and observe the latency to confirm and extract data.