What’s Vulnerable › Vulnerabilities

CVE-2022-50997: Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-09-30
• Weakness: CWE-89

Description

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Affected products

• Weaver Network Co., Ltd. E-cology 8.0: before 10.53; before 10.54 — fixed in 10.53, 10.54
• Weaver Network Co., Ltd. E-cology 9.0: before 10.53; before 10.54 — fixed in 10.53, 10.54

How to fix

Upgrade to a fixed version: Weaver Network Co., Ltd. E-cology 8.0 10.53, 10.54; Weaver Network Co., Ltd. E-cology 9.0 10.53, 10.54. Check the vendor advisory for mitigations.

References

• https://cn-sec.com/archives/1211578.html
• https://peiqi.wgpsec.org/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20HrmCareerApplyPerView.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
• https://www.vulncheck.com/advisories/weaver-e-cology-sql-injection-via-hrmcareerapplyperview-jsp
• https://www.weaver.com.cn/cs/ecology_full_log_en.html
• https://www.weaver.com.cn/cs/securityDownload.html#

Get alerted when CVE-2022-50997 or the next vulnerability affects your stack