Read the docs
TI-2022-26436 Aliases CVE-2022-50997GHSA-p597-c7c2-qj48

Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

Priority HIGH 77CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00621 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed E-cology 9.0 (Weaver Network Co., Ltd.): 10.53, 10.54E-cology 8.0 (Weaver Network Co., Ltd.): 10.53, 10.54

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Weaver Network Co., Ltd.E-cology 9.0before 10.53; before 10.5410.53, 10.54Patch availableCNA
Weaver Network Co., Ltd.E-cology 8.0before 10.53; before 10.5410.53, 10.54Patch availableCNA
  • E-cology 9.0 VendorWeaver Network Co., Ltd. Affected before 10.53; before 10.54 Fixed in 10.53, 10.54 Patch available CNA
  • E-cology 8.0 VendorWeaver Network Co., Ltd. Affected before 10.53; before 10.54 Fixed in 10.53, 10.54 Patch available CNA

Remediation

  • Fix · CNA E-cology 9.0 (Weaver Network Co., Ltd.) Fixed in 10.53, 10.54
  • Fix · CNA E-cology 8.0 (Weaver Network Co., Ltd.) Fixed in 10.53, 10.54

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50997
  2. 2026-10-03 Alias added: GHSA-p597-c7c2-qj48
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2022-26434 Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet CVSS 4.0CRITICAL 9.3
  • TI-2022-04582 Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp CVSS 4.0CRITICAL 9.3
  • TI-2025-43962 Unauthenticated SQL injection in Weaver E-cology CVSS 4.0HIGH 8.8
  • TI-2021-22764 Unauthenticated path traversal in Weaver E-cology reads server files CVSS 4.0HIGH 8.7
  • TI-2019-15817 Weaver E-cology SQL Injection via SyncUserInfo.jsp CVSS 4.0HIGH 8.7
  • TI-2016-09273 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad CVSS 4.0HIGH 8.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences