The Zechat 1.5 script exposes a classic SQL injection flaw in its profile.php endpoint, allowing any sender to place malicious SQL statements in the uname query parameter. Because authentication is not required, an attacker can simply craft a request with UNION‑based payloads to read the contents of the information_schema database, revealing table names, column names, and potentially sensitive data stored in the application database. The vulnerability falls under the CWE‑89 family of injection weaknesses, directly threatening the confidentiality and integrity of the underlying data.

Vendors identified by the CNA list Bylancer:Zechat as the affected product. Zechat version 1.5—identified in several CPE entries—is the only version cited as vulnerable. No additional version range information is provided, so all installations of the 1.5 release should be regarded as impacted until an updated patch is released.

This weak point carries a CVSS score of 8.8, with no EPSS score reported and exclusion from CISA’s KEV catalog, indicating that while exploitation is technically feasible, it has a high impact when achieved. The likely attack vector is a network‑based HTTP request to profile.php from an unauthenticated client, meaning any user with network access to the web server can attempt the injection and retrieve sensitive database information if no countermeasures are in place.