Weaver E-cology CVE-2025-71434

No special conditions beyond network reachability - unauthenticated remote exploitation against default configurations of Weaver E-cology, with no user interaction and no privileges required (PR:N/UI:N). The concrete prerequisites are: a reachable /api/doc/out/more/list endpoint invoked with srcType=2, SQL injected through the doc_datefrom and doc_dateto fields, and the companion /api/ec/dev/table/counts endpoint used to read query results. The primary limiting factor is version: only E-cology 8.0, 9.0, and 10.0 releases prior to 10.76 are affected, so instances already upgraded to 10.76 or later are not exploitable; exposure also depends on the endpoints being network-accessible to the attacker (e.g., internet-facing deployments).

Multiple signals align toward genuine priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 8.8) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction - the easiest class to exploit at scale. The vuln.today Decision label is 'this_week', and the description states the Shadowserver Foundation first observed exploitation evidence on 2026-07-19, indicating real-world attacker interest rather than purely theoretical risk. A vendor patch is available and the finding was reported by VulnCheck, which published an advisory. Multiple public PoC references exist (two Chinese research write-ups and a ProjectDiscovery Nuclei template), meaning detection/triggering content is readily reusable even though none is confirmed as a weaponized working exploit. Impact is weighted toward disclosure (VC:H, VI:L, VA:N) consistent with a read-oriented SQL injection used to extract database information. Key gaps: no EPSS score is provided in the input, and the vulnerability is NOT listed in CISA KEV - so the observed exploitation is attributed to Shadowserver telemetry, not CISA confirmation. Net: for internet-exposed Weaver E-cology instances below 10.76 this is a real, patch-now-class issue, not a high-CVSS-but-low-real-risk item.

An unauthenticated remote attacker sends a crafted request to the /api/doc/out/more/list endpoint with srcType=2, injecting SQL through the doc_datefrom/doc_dateto parameters, then retrieves the query output through /api/ec/dev/table/counts to read arbitrary database contents such as credentials and business data. Because no authentication or user interaction is required (PR:N/UI:N) and a Nuclei template plus public research write-ups exist, mass internet-wide scanning and exploitation is straightforward; the PoC references are not verified as working exploit code.