Back to KEVs

CVE-2025-34038

Weaver E-cology SQL Injection

Basic Information

CVE State
PUBLISHED
Reserved Date
April 15, 2025
Published Date
June 24, 2025
Last Updated
May 14, 2026
Vendor
Weaver
Product
E-cology
Description
A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Tags
nuclei_scanner

CVSS Scores

CVSS v4.0

8.7 - HIGH

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC Information

Exploitation
poc
Automatable
Yes
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2026-01-29 00:00:00 UTC) Source

References

https://www.cnblogs.com/0day-li/p/14637680.html https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 https://weaver.com.co/products/ecology/ https://vulncheck.com/advisories/fanwei-ecology-sql-injection

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-01-29 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34038.yaml 2026-06-01 15:34:41 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei