Vulnerability · Published Jun 24, 2025 · Assigned by VulnCheck

CVE-2025-34038Weaver E-cology SQL Injection

High 8.7

In plain English

A high-severity SQL injection in E-cology from Weaver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)2.1%top 18.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Affected products (as reported)

Vendor	Product	Versions
Weaver	E-cology	0 – through 8.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.cnblogs.com/0day-li/p/14637680.html exploit, technical-description
https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 third-party-advisory
https://weaver.com.co/products/ecology/ product
https://vulncheck.com/advisories/fanwei-ecology-sql-injection third-party-advisory