Description

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T18:17:16.617Z",
  "pubdate": "2026-08-11T18:17:16.617Z",
  "executiveSummary": "Weaver (Fanwei) E-cology 8.0 suffers from an unauthenticated SQL injection vulnerability located within the SignatureDownLoad servlet.\nThe vulnerability allows remote attackers without prior authentication to read arbitrary files from the underlying filesystem by manipulating the vulnerable markId GET parameter.\nBy injecting a crafted UNION SELECT payload into the unsanitized parameter, an adversary can control the query-derived markPath value, forcing the application to read and stream back sensitive files accessible to the application server process.\nThe primary risk implication includes the potential exposure of sensitive configuration files containing database credentials and other system secrets.\nExploitation requires network access to the vulnerable servlet, and active exploitation in the wild was first observed by the Shadowserver Foundation on October 18, 2023.\nAlthough disclosure materials indicate the vulnerability has been remediated, the specific fixed version remains unclear.",
  "technicalDetails": "The vulnerability resides in the SignatureDownLoad servlet of Weaver (Fanwei) E-cology 8.0, which exposes an endpoint vulnerable to SQL injection due to improper input sanitization.\nThe root cause is the direct concatenation of user-supplied input from the markId GET parameter into an internal SQL query string without adequate parameterization or escaping.\nUnauthenticated remote attackers can exploit this flaw by supplying a malicious payload containing a UNION SELECT statement via the markId parameter.\nThe step-by-step attack flow begins when an attacker sends an HTTP GET request to the SignatureDownLoad servlet with the injected markId parameter.\nThe application processes the unsanitized input and executes the resulting malicious SQL query against the database backend.\nThe injected UNION SELECT clause manipulates the query results to return an attacker-controlled filesystem path within the markPath field.\nUpon receiving the query output, the SignatureDownLoad servlet utilizes the attacker-controlled markPath value to locate, read, and stream the targeted file back to the remote client over the network.\nThe technical impact involves complete loss of confidentiality regarding files accessible to the privileges of the application server process.\nPost-exploitation impact includes the retrieval of sensitive system configuration files, such as those containing database credentials, which can facilitate further network compromise or lateral movement.\nThe affected component is the SignatureDownLoad servlet within Weaver (Fanwei) E-cology version 8.0, operating with network exposure and requiring no authentication or privileges."
}