CVE-2022-50997: Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weaver (Fanwei) E-cologyto a version that resolves this vulnerability.Fixed in 10.53 - Upgrade
Upgrade
Weaver (Fanwei) E-cologyto a version that resolves this vulnerability.Fixed in 10.54
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50997?
CVE-2022-50997 has a severity rating of high with a score of 7.5.
How does CVE-2022-50997 allow attackers to exploit the system?
CVE-2022-50997 enables unauthenticated remote attackers to execute SQL injection via the HrmCareerApplyPerView.jsp endpoint by manipulating the id GET parameter.
What can attackers achieve with CVE-2022-50997?
Attackers exploiting CVE-2022-50997 can extract arbitrary data from the backend database.
What software versions are affected by CVE-2022-50997?
CVE-2022-50997 affects Weaver (Fanwei) E-cology versions 8.0 and 9.0.
How can users protect against CVE-2022-50997?
Users can mitigate CVE-2022-50997 by applying security updates provided by Weaver (Fanwei) that address the SQL injection vulnerability.