Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1.
References
| Link | Resource |
|---|---|
| https://gist.github.com/CoinIsMoney/8ca1f2bf2e0399724c698327f2da8579 | Third Party Advisory |
| https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng4.pdf | Broken Link |
Configurations
Configuration 1 (hide)
|
History
05 Jun 2025, 13:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:weaver:e-cology:9.0:*:*:*:*:*:*:* cpe:2.3:a:weaver:e-cology:8.0:*:*:*:*:*:*:* |
|
| References | () https://gist.github.com/CoinIsMoney/8ca1f2bf2e0399724c698327f2da8579 - Third Party Advisory | |
| References | () https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng4.pdf - Broken Link | |
| First Time |
Weaver
Weaver e-cology |
21 Nov 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 |
19 Nov 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-19 18:15
Updated : 2025-06-05 13:58
NVD link : CVE-2024-48072
Mitre link : CVE-2024-48072
CVE.ORG link : CVE-2024-48072
JSON object : View
Products Affected
weaver
- e-cology
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')