Description
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Weaver Network | E-cology | < 10.76 | 10.76 |
References
- y4tacker Blog technical-description exploit
- 1diot9 Blog technical-description exploit
- Nuclei Template technical-description
- CSDN Blog technical-description
- Vendor Advisory vendor-advisory patch
- VulnCheck Advisory: Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list third-party-advisory