CVE-2025-34038

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34038
A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://vulncheck.com/advisories/fanwei-ecology-sql-injection Exploit Third Party Advisory
https://www.cnblogs.com/0day-li/p/14637680.html Exploit
https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 Third Party Advisory
https://www.weaver.com.cn/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
History

20 Nov 2025, 22:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-13 UTC. (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

17 Nov 2025, 22:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-13 UTC.

23 Sep 2025, 19:26

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://vulncheck.com/advisories/fanwei-ecology-sql-injection - () https://vulncheck.com/advisories/fanwei-ecology-sql-injection - Exploit, Third Party Advisory
References () https://www.cnblogs.com/0day-li/p/14637680.html - () https://www.cnblogs.com/0day-li/p/14637680.html - Exploit
References () https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 - () https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 - Third Party Advisory
References () https://www.weaver.com.cn/ - () https://www.weaver.com.cn/ - Product
CPE cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
First Time Weaver
Weaver e-cology

26 Jun 2025, 18:58

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección SQL en Fanwei e-cology 8.0 a través del endpoint getdata.jsp. La aplicación pasa directamente la entrada de usuario no saneada del parámetro sql a una consulta de base de datos dentro del método getSelectAllIds(sql, type), accesible mediante el flujo de trabajo cmd=getSelectAllId en AjaxManager. Esto permite a atacantes no autenticados ejecutar consultas SQL arbitrarias, lo que podría exponer datos confidenciales, como hashes de contraseñas de administrador.

24 Jun 2025, 03:15

Type Values Removed Values Added
References
  • {'url': 'https://vulncheck.com/advisories/fanwei-e-cology-sql-injection', 'source': 'disclosure@vulncheck.com'}
  • () https://vulncheck.com/advisories/fanwei-ecology-sql-injection -
Summary (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 and prior via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes.

24 Jun 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-24 02:15

Updated : 2025-11-20 22:15

NVD link : CVE-2025-34038

Mitre link : CVE-2025-34038

CVE.ORG link : CVE-2025-34038

JSON object : View

Products Affected

weaver

  • e-cology
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')