Zechat SQL Injection Vulnerability in v Parameter

A SQL injection vulnerability has been identified in Zechat version 1.5. The issue resides in the 'v' parameter, allowing unauthenticated attackers to extract database information using time-based blind injection techniques. Exploitation of this vulnerability involves using sleep-based payloads to confirm the injection and retrieve data.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to extract, modify, or delete database information. In this case, the vulnerability was exploited to perform time-based blind SQL injection, a technique where the attacker determines the presence of a vulnerability based on the application's response time.

Reproduction

The vulnerability can be reproduced by sending a request to the 'v' parameter with a payload that includes a SQL injection, such as 'AND sleep(10)'. This payload exploits the application's database query handling by causing a delay in the response, indicating that the injection was successful. Additionally, the 'hashtag' parameter can be used for union-based SQL injection, bypassing Cross-Site Request Forgery (CSRF) protections.