Description

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T15:16:57.600Z",
  "pubdate": "2026-08-07T15:16:57.600Z",
  "executiveSummary": "Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a critical file upload vulnerability that exposes enterprise environments to severe remote code execution risks.\nThe vulnerability is classified as an arbitrary file upload flaw, enabling remote, unauthenticated threat actors to upload arbitrary files, including malicious Java Server Pages (JSP) webshells, directly to the underlying application server.\nSuccessful exploitation grants attackers full remote code execution capabilities operating under the privilege context of the application server process, potentially leading to total system compromise, data exfiltration, and lateral movement within the internal network.\nThe affected product is Weaver (Fanwei) E-cology version 9.0 prior to 10.52.\nExploitation requires no prior authentication or administrative privileges, significantly lowering the attack barrier.\nActive exploitation in the wild was first observed by the Shadowserver Foundation on October 14, 2023, underscoring the urgency for remediation and defensive hardening.",
  "technicalDetails": "The vulnerability resides in the file upload mechanism handled by the vulnerable component located at the endpoint /workrelate/plan/util/uploaderOperate.jsp within Weaver (Fanwei) E-cology 9.0 prior to versions 10.52.\nThe root cause stems from insufficient input validation, weak access controls, and improper sanitization of multipart/form-data POST requests submitted to the application.\nRemote, unauthenticated attackers can interact directly with the network-exposed endpoint without supplying valid session identifiers or credentials.\nThe attack flow initiates when an adversary crafts a malicious HTTP POST request incorporating a multipart/form-data payload directed at /workrelate/plan/util/uploaderOperate.jsp.\nThe request includes arbitrary parameter values for secId and plandetailid fields, which are improperly validated by the backend logic, bypassing expected security constraints and authorization checks.\nDue to the lack of strict file type validation and extension filtering, the application permits the upload of executable script files, such as JSP webshells, into web-accessible directories.\nFollowing the successful file upload, the payload behavior allows the attacker to execute arbitrary system commands and operational instructions by issuing HTTP requests directly to the newly planted webshell.\nThe post-exploitation impact results in remote code execution under the exact privileges assigned to the application server process, enabling threat actors to read, modify, or delete sensitive enterprise data, install persistent backdoors, and pivot to adjacent network segments."
}