Description

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T18:17:16.910Z",
  "pubdate": "2026-08-11T18:17:16.910Z",
  "executiveSummary": "Weaver (Fanwei) E-cology versions 8.0 and 9.0 contain a critical SQL injection vulnerability residing within the HrmCareerApplyPerView.jsp endpoint. This security flaw enables unauthenticated remote attackers to execute arbitrary database queries against the underlying Microsoft SQL Server backend. By manipulating the unsanitized id GET parameter with crafted UNION-based injection payloads, unauthorized actors can extract sensitive data directly from the database. The high severity of this vulnerability stems from its lack of authentication requirements, allowing remote network-based exploitation without prior system access or user interaction. Potential remediation is identified in software version 10.53 or 10.54. Real-world exploitation activity was first tracked by the Shadowserver Foundation on October 18, 2023, highlighting its active targeting in the threat landscape. Organizations utilizing vulnerable instances face severe risks including complete data compromise, unauthorized information disclosure, and potential lateral movement or deeper system compromise depending on database privilege configurations.",
  "technicalDetails": "The vulnerability is classified as an SQL injection flaw affecting the HrmCareerApplyPerView.jsp endpoint within Weaver (Fanwei) E-cology 8.0 and 9.0. The root cause of the vulnerability is the improper neutralization of special elements used in an SQL command within the id GET parameter. Specifically, the application fails to adequately sanitize, validate, or parameterize user-supplied input before directly concatenating or processing it within database queries executed against the Microsoft SQL Server backend.\nExploitation of this vulnerability requires no authentication or special privileges, making it accessible to unauthenticated remote attackers over the network. To exploit the flaw, an attacker sends a single HTTP GET request containing a crafted payload directed at the vulnerable HrmCareerApplyPerView.jsp file. The attack flow initiates when the malicious request hits the web server, which passes the unsanitized input supplied in the id parameter directly to the database query logic.\nThe attack vector leverages UNION-based SQL injection techniques. By appending specially crafted UNION SELECT statements to the id parameter, the attacker can manipulate the structure of the original database query executed by the Microsoft SQL Server. This forces the database engine to combine the results of the legitimate application query with the attacker-controlled query results, returning the extracted arbitrary data directly within the HTTP response or application interface.\nPost-exploitation impact includes the unauthenticated extraction of sensitive enterprise data stored within the backend Microsoft SQL Server database, such as internal user credentials, organizational records, and proprietary business information. Threat intelligence indicates that this vulnerability has been actively targeted in the wild, with exploitation evidence first observed by the Shadowserver Foundation on 2023-10-18 (UTC). Remediation efforts require updating the affected software to version 10.53, 10.54, or later versions where the input validation and parameterization issues are addressed."
}