Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2022-50997Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

High 7.5

In plain English

A high-severity SQL injection in E-cology 8.0 from Weaver Network Co., Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Affected products (as reported)

Vendor	Product	Versions
Weaver Network Co., Ltd.	E-cology 9.0	0 – before 10.530 – before 10.54
Weaver Network Co., Ltd.	E-cology 8.0	0 – before 10.530 – before 10.54

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Software Download Page patch
E-cology Changelog release-notes
PeiQi Disclosure technical-description, exploit
CN-SEC Disclosure third-party-advisory
https://www.vulncheck.com/advisories/weaver-e-cology-sql-injection-via-hrmcareerapplyperview-jsp third-party-advisory