CVE-2025-34038: Weaver E-cology SQL Injection
A SQL injection vulnerability exists in Weaver e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34038?
CVE-2025-34038 is classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive data via SQL injection.
How do I fix CVE-2025-34038?
To fix CVE-2025-34038, sanitize user inputs in the getdata.jsp endpoint and implement prepared statements to mitigate SQL injection risks.
Which software versions are affected by CVE-2025-34038?
CVE-2025-34038 affects Fanwei e-cology versions 8.0 and prior.
What types of attacks can CVE-2025-34038 facilitate?
CVE-2025-34038 can facilitate SQL injection attacks, potentially leading to data breaches and unauthorized database access.
Is CVE-2025-34038 publicly disclosed?
Yes, CVE-2025-34038 is publicly disclosed and documented in various security vulnerability databases.