cve-2022-50997
HIGH CVSS 8.7 vulncheck_kev
Description
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Timeline
- Published
- 2026-08-11 00:00 UTC
- Last Modified
- 2026-08-11
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 8.7,
"datePublished": "2026-08-11T00:00:00Z",
"dateUpdated": "2026-08-11T00:00:00Z",
"description": "Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).",
"dueDate": "",
"id": "CVE-2022-50997",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "E-cology 9.0",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "HIGH",
"source": "vulncheck_kev",
"title": "Weaver e-cology Improper Neutralization of Special Elements used in an SQL Command",
"vendor": "Weaver Network Co., Ltd."
}