Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25382. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This is a functional SQL injection exploit for Zechat 1.5, targeting the 'uname' parameter in profile.php. The payload uses UNION-based injection to extract table and column names from the information_schema database.
Description
Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column names, and sensitive data from the information_schema database.
Exploits (1)
This is a functional SQL injection exploit for Zechat 1.5, targeting the 'uname' parameter in profile.php. The payload uses UNION-based injection to extract table and column names from the information_schema database.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N