CVE-2019-25776— Weaver E-cology SQL Injection via SyncUserInfo.jsp
Quick assessment
Affected
Weaver Network Co., Ltd. E-cology
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Weaver E-cology 存在一个无需身份验证的 SQL 注入漏洞，远程攻击者可通过在移动插件端点的 GET 参数中提交恶意输入，执行任意 SQL 查询。攻击者可通过将 SQL 关键词用括号包裹来绕过基于空格的过滤控制，实施 UNION 型注入，从而从数据库中提取敏感数据，包括管理员账户的凭证哈希值。该漏洞利用的首次证据由 Shadowserver 基金会于 2022-07-28 观察到。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Weaver Network Co., Ltd. | E-cology | * |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-25776
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weaver E-cology SQL Injection via SyncUserInfo.jsp
Source: CVE Program / CVE List V5
Vulnerability Description
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Weaver Network Co., Ltd. | E-cology | * | - |
|
II. Public POCs for CVE-2019-25776
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-25776
请登录查看更多情报信息。
Patches & Fixes for CVE-2019-25776 (1)
Other References for CVE-2019-25776 (2)
-
🔗 Weaver E-cology SQL Injection via SyncUserInfo.jsp | Advisories | VulnCheck third-party-advisory
-
IV. Related Vulnerabilities
Same product: E-cology
-
CVE-2022-50992
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via -
CVE-2026-22679
Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug -
CVE-2025-34038
Weaver E-cology SQL Injection -
CVE-2024-7704
Weaver e-cology Source Code ecology_dev.zip information disc -
CVE-2023-3793
Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc
Same vendor: Weaver Network Co., Ltd.
-
CVE-2022-50997
Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPe -
CVE-2016-20097
Weaver E-cology 8.0 SQL Injection File Read via SignatureDow -
CVE-2022-4995
Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp -
CVE-2022-50992
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via -
CVE-2022-50993
Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary Fi
Same weakness: CWE-89
-
CVE-2026-18443
Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL In -
CVE-2026-96267
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthent -
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via -
CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injectio -
CVE-2026-95865
Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Con
V. Comments for CVE-2019-25776
No comments yet