Description
A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Weaver | E-cology | ≤ 8.0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Fanwei e-cology - SQL Injection http/cves/2025/CVE-2025-34038.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.cnblogs.com/0day-li/p/14637680.html exploit technical-description
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 third-party-advisory
- https://weaver.com.co/products/ecology/ product
- https://vulncheck.com/advisories/fanwei-ecology-sql-injection third-party-advisory