CVE-2022-4995
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Weaver (Fanwei) E-cology 9.0 before 10.52 has a file upload vulnerability allowing remote unauthenticated attackers to upload arbitrary files, including JSP webshells, via a POST request to /workrelate/plan/util/uploaderOperate.jsp, leading to remote code execution.
Risk Assessment
An attacker can gain full control of the application server, potentially leading to data breaches and further network attacks.
Recommendation
Upgrade Weaver E-cology to version 10.52 or later and restrict access to the application.
Other vulnerabilities in Weaver E-cology
See all- CVE-2023-51892Critical
An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script sent to the FrameworkShellController component.
- CVE-2019-25776High
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries via the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filters by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes.
- CVE-2022-50997High
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
- CVE-2016-20097High
Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Original NVD description (English source)
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).