CVE-2018-25382 is a SQL injection vulnerability in Zechat 1.5 that allows unauthenticated attackers to extract database information. The vulnerability exists in the uname parameter of profile.php, where attackers can inject UNION-based SQL payloads. Exploitation enables retrieval of table names, column names, and sensitive data from the information_schema database. The vulnerability requires no authentication, making it particularly dangerous. Proof-of-concept exploits are publicly available.