CVE-2025-34038CWE-89

Weaver E-cology SQL Injection

High · published June 24, 2025

CVSS v4.0
8.7
EPSS
2%
Percentile
81.7
In the wild
Unconfirmed
What it is

A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.02117 · 81.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-06-24T01:06Z
EPSS history
Timeline
  • 24 JUN 01:06Z
    Weaver E-cology SQL Injection
    cvelistv5