Executive brief
Weaver E-cology, a widely-deployed office automation system in China, contains an unauthenticated SQL injection vulnerability in its mobile plugin that allows attackers to extract sensitive data from the database. Attackers can bypass the application's SQL keyword filters by wrapping keywords in parentheses, enabling them to harvest administrator credential hashes and other confidential information without needing to authenticate first.
Technical details
The vulnerability exists in the mobile plugin endpoint (SyncUserInfo.jsp) where the userIdentifiers GET parameter is not properly sanitized before being used in SQL queries. Attackers can perform UNION-based SQL injection by submitting specially-crafted input that bypasses space-based filter controls, allowing arbitrary query execution. The vulnerability requires only network access and no authentication; exploitation yields unauthorized access to sensitive database records including administrator credentials.
Affected products
- Weaver E-cology
Timeline
- 2019: disclosed: CVE-2019-25776 assigned
- 2022-07-28: exploited: Exploitation observed by Shadowserver Foundation