A critical SQL injection vulnerability in Bylancer Zechat 1.5 allows unauthenticated attackers to extract data from the backend database.

The application is susceptible to a time-based blind SQL injection (CWE-89) in the 'v' parameter, allowing an unauthenticated attacker to inject malicious SQL queries and infer database content.

This vulnerability allows unauthorized access to the application's database, potentially leading to the theft of sensitive user data, credentials, or administrative information. With a CVSS score of 8.2, this represents a severe risk to data confidentiality and application integrity.

Immediate Action: Upgrade to the latest version of Zechat that includes a fix for this SQL injection vulnerability.

Proactive Monitoring: Review database audit logs for unusual query patterns, particularly those involving time-delay functions or unexpected syntax.

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious input in the 'v' parameter.

Public Exploit Available: Yes — a public exploit exists via ExploitDB (ID 44685).

The presence of a publicly available exploit for this vulnerability makes it a high-priority target for automated scanning and manual attacks. Administrators must apply the vendor-provided patch or upgrade the software immediately to prevent data breach scenarios.