CN-SEC DisclosureThird-party advisory
https://cn-sec.com/archives/1211578.html CVE-2022-50997
HIGH
Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Record summary
CVE-2022-50997 has a selected CVSS score of 8.7 (high).
Description
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Aug 11, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
E-cology 8.0Browse Weaver Network Co., Ltd. / E-cology 8.0Default status: affected | CVE List | Before 10.53 | unknown |
| Before 10.54 | unknown | ||
E-cology 9.0Browse Weaver Network Co., Ltd. / E-cology 9.0Default status: affected | CVE List, VulnCheck | Before 10.53 | unknown |
| Before 10.54 | unknown |
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-50997 PeiQi DisclosureTechnical descriptionexploit
https://peiqi.wgpsec.org/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20HrmCareerApplyPerView.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/weaver-e-cology-sql-injection-via-hrmcareerapplyperview-jsp E-cology Changelogrelease notes
https://www.weaver.com.cn/cs/ecology_full_log_en.html Software Download Pagepatch
https://www.weaver.com.cn/cs/securityDownload.html