E Cology EUVD-2025-19038

This vulnerability represents critical real-world risk despite a CVSS 3.1 base score of 7.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the lowest complexity attack requiring zero privileges and no user interaction—all factors favoring attacker success. The High Confidentiality impact (C:H) reflects the ability to extract sensitive data including password hashes. Crucially, active exploitation evidence from Shadowserver Foundation (2025-02-05) indicates this has progressed beyond theoretical POC to real-world attacks, placing it in CISA KEV candidate status. The attack surface is maximized by: (1) unauthenticated access requirement, (2) network-accessible JSP endpoint, and (3) SQL injection being one of the most trivially automatable vulnerability classes. While CVSS shows no integrity or availability impact (I:N/A:N), the confidentiality breach combined with exploitation evidence and ease of automation elevates this to critical priority. Organizations running Weaver E-cology 8.0 should treat this as emergency-level, particularly if exposed to untrusted networks.

An unauthenticated attacker on the public internet crafts an HTTP request to the vulnerable getdata.jsp endpoint: GET /e-cology/ajax.do?cmd=getSelectAllId&sql=UNION+SELECT+password,username+FROM+admin_users-- HTTP/1.1. The AjaxManager processes the request, passes the injected SQL directly to the database query without sanitization, and returns administrator username and password hash pairs to the attacker. The attacker then uses offline password cracking tools to recover plaintext passwords or uses hash-spraying techniques. With administrator credentials, the attacker gains full control of the Weaver E-cology instance, enabling data exfiltration, document manipulation, or lateral movement into the enterprise network. The attack requires no authentication, no special tools (standard HTTP client suffices), and can be fully automated. Time-to-exploitation is minutes. Exploitation evidence in Shadowserver Foundation logs confirms active attackers are already executing variations of this scenario.