CVE-2019-25776
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries via the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filters by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes.
Risk Assessment
The risk to the organization includes unauthorized access to the database, potentially leading to exposure of confidential data, including administrator credentials, and possible system compromise.
Recommendation
It is recommended to apply vendor patches immediately and restrict access to mobile plugin endpoints. Also, conduct a security audit to detect any signs of exploitation.
Other vulnerabilities in Weaver E-cology
See all- CVE-2022-4995Critical
Weaver (Fanwei) E-cology 9.0 before 10.52 has a file upload vulnerability allowing remote unauthenticated attackers to upload arbitrary files, including JSP webshells, via a POST request to /workrelate/plan/util/uploaderOperate.jsp, leading to remote code execution.
- CVE-2023-51892Critical
An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script sent to the FrameworkShellController component.
- CVE-2022-50997High
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
- CVE-2016-20097High
Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Original NVD description (English source)
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.