Executive brief
Weaver E-cology 8.0 is enterprise collaboration software used to manage organizational workflows and document management. A SQL injection vulnerability in the SignatureDownLoad servlet allows unauthenticated attackers to read arbitrary files from the server, including sensitive configuration files containing database credentials. This enables complete compromise of the underlying database and potentially the entire system.
Technical details
The vulnerability is a SQL injection (CWE-89) in the SignatureDownLoad servlet where the markId GET parameter is concatenated unsanitized into a SQL query. Attackers exploit this by injecting a UNION SELECT payload to control the markPath value returned by the query, allowing them to specify arbitrary filesystem paths. The servlet then reads and streams back files accessible to the application server process. No authentication is required; the vulnerability is network-reachable via HTTP GET requests. Remediation materials exist but the specific patched version is unclear.
Affected products
- Weaver E-cology 8.0
Timeline
- 2016: disclosed: Original disclosure (WooYun-2016-0198158)
- 2023-10-18: exploited: Exploitation evidence first observed by Shadowserver Foundation
- 2026-08-11: advisory: Published to NVD and VulnCheck